As reported by The Hacker News, a critical path traversal vulnerability in Fortinet FortiSIEM — CVE-2026-106173 (CVSS 9.4) — now has a publicly available proof-of-concept exploit courtesy of Horizon3.ai. The flaw enables unauthenticated remote code execution through FortiSIEM's gRPC service, and with PoC code circulating, defenders face a narrow window before mass scanning and exploitation begins.

Security Impact: As reported by The Hacker News, a critical path traversal vulnerability in Fortinet FortiSIEM — CVE-2026-106173 (CVSS 9.4) — now has a publicly available proof-of-concept exploit courtesy of Horizon3.ai.

Why This Vulnerability Stands Out

This isn't just another path traversal bug. The exploit chain demonstrates a elegant two-stage primitive that elevates what would normally be a limited arbitrary-file-write into full RCE:

  • Stage 1 — Path Traversal: The SendQueryResult() function passes a user-supplied query-id parameter directly into a file path without adequate sanitization. Attackers inject ../ sequences to escape the intended directory.
  • Stage 2 — NUL-byte Injection: The server auto-appends a filename suffix, which would normally prevent attackers from choosing their target file. By embedding a NUL byte (\0) in the traversal payload — encoded within gRPC's HTTP/2 and HPACK layers — the OS truncates the path at the NUL, discarding the appended suffix entirely.

The target? A Redis health-check shell script (redishb.sh) executed by cron every 60 seconds. Overwriting that script with attacker-controlled content yields near-instant code execution as whatever context runs the cron job — likely root or a privileged service account.

Vulnerability Details

CVECVE-2026-106173
CVSS Score9.4 (Critical)
VendorFortinet
ProductFortiSIEM
Affected VersionsFortiSIEM 7.5.0
Not AffectedFortiSIEM 7.6
Patch AvailableYes — upgrade to FortiSIEM 7.5.1 or above
Attack VectorNetwork (unauthenticated gRPC on TCP 27918)
ImpactArbitrary code execution, full system compromise
Active ExploitationPoC publicly released; active exploitation likely imminent

The SIEM-as-Target Problem

Security information and event management platforms occupy a uniquely dangerous position when they become the attack surface. FortiSIEM appliances typically run with elevated privileges, hold credentials for integrated infrastructure, and maintain network reachability to logging sources across the enterprise. An attacker who achieves RCE on a SIEM node doesn't just compromise one server — they potentially gain access to every system feeding it logs, credentials stored for integrations, and the visibility pipeline defenders rely on to detect the attack itself.

This creates a secondary concern: post-compromise, attackers can manipulate or suppress security telemetry to cover their tracks. A compromised FortiSIEM may continue ingesting logs but selectively drop or alter events that would reveal lateral movement, making incident response significantly harder if the initial compromise goes undetected.

Who Is Most Exposed

The SIEM-as-Target Problem
Organizations running FortiSIEM 7.5.0 who have not yet patched — this is the primary risk group
Deployments where TCP port 27918 is reachable from untrusted networks or broad internal zones
Environments where FortiSIEM is internet-facing for multi-site log aggregation without proper network segmentation
MSSP and managed security environments where the gRPC service may be exposed to customer networks

Shield53 Recommendations

Immediate Actions

  • Patch immediately: Upgrade FortiSIEM 7.5.0 to version 7.5.1 or above. If immediate patching isn't feasible, apply network-layer compensating controls now.
  • Restrict port 27918: Ensure the FortiSIEM gRPC service is not reachable from untrusted networks. Limit access to authorized internal management subnets using firewall rules or host-based ACLs.
  • Inventory exposure: Identify all FortiSIEM deployments across your environment. Check for systems still running 7.5.0 that may have been missed in initial patching efforts.
  • Review for compromise: Examine FortiSIEM logs and the host system for evidence of exploitation — unusual files written outside expected directories, modifications to redishb.sh or other cron scripts, unexpected outbound connections from the FortiSIEM host, and any gaps or anomalies in security telemetry around the time the gRPC service was exposed.
  • Verify file integrity: Check the contents of /opt/charting/redishb.sh and any other scripts in the FortiSIEM installation path for unauthorized modifications.
  • Rotate credentials: If compromise is suspected, rotate all credentials stored in FortiSIEM for integrations — LDAP bindings, API keys, SSH keys, database credentials, and any cloud provider tokens.

Strategic Recommendations

  • Segment management interfaces: Security tooling management planes should never be reachable from general user networks, let alone the internet. Enforce strict east-west controls around SIEM infrastructure.
  • Monitor gRPC traffic: Deploy detection rules for anomalous connections to TCP 27918, particularly from unexpected source IPs or containing path traversal patterns in metadata.
  • Adopt file integrity monitoring: Implement FIM on critical script paths within security infrastructure to catch unauthorized modifications in real time.

The release of this PoC compresses the remediation timeline dramatically. Organizations running affected FortiSIEM versions should treat this as an active incident — patch, verify, and investigate for signs of prior exploitation. When the tool you use to detect attacks becomes the attack vector, the cost of delay compounds rapidly.