This week, cybersecurity researchers at Horizon3.ai published a public Proof of Concept (PoC) exploit for a recently patched vulnerability in Fortinet’s FortiSIEM product.
The vulnerability was discovered by Fortinet on October 13. Tracked as CVE-2026-106173 (CVSS score 9.4), it is a critical path traversal flaw that unauthenticated attackers could use to remotely execute unauthorized code or commands within affected systems.
Horizon3.ai’s PoC exploit shows how a gRPC service on TCP port 27918 does not require a client certificate for authentication.
“This means any remote client can connect to the gRPC service on port tcp/27918 unauthenticated and without presenting a client certificate to reach the vulnerable gRPC service,” said Zach Hanley, Chief Attack Engineer at Horizon3.ai.
Once connected, the attacker could traverse outside of the query directory and take arbitrary control. From there, they could write an arbitrary file onto the file system and overwrite a periodically executed script so that it remotely executes malicious code or commands.
IOCs And Remediation Guidance
Fortinet is urging customers using FortiSIEM v7.5.0 to upgrade to version 7.5.1 or above. FortiSIEM 7.6 and FortiSIEM Cloud are not affected by this vulnerability.
Customers can also prevent the issue by restricting access on TCP port 27918.
According to Horizon3.ai, there aren’t any application logs that reveal that an attacker has exploited the vulnerability. However, security teams can inspect the file write or modified timestamps of existing scripts and compare them with surrounding file timestamps, to determine whether an existing script has been overwritten.
