cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Public PoC Exploits Critical FortiSIEM Flaw for Unauthenticated Remote Code Execution

· Original article ↗

Summary

A public PoC targets a critical, recently patched FortiSIEM flaw, CVE-2026-106173. Path traversal and null-byte injection can turn arbitrary file writes into unauthenticated remote code execution.

Key points

  • CVE-2026-106173 has a CVSS score of 9.4 and affects Fortinet FortiSIEM.
  • The flaw involves unsafe path construction in the gRPC QueryResultReq handler, which processes untrusted metadata without proper path validation.
  • An unauthenticated attacker can connect to the gRPC service on TCP port 27918 and use path traversal to write outside the intended directory.
  • Null-byte injection can bypass the program’s appended filename suffix, allowing an attacker to overwrite a chosen existing file.
  • Horizon3.ai described a method targeting a Redis health-check shell script that runs every 60 seconds; a second variant can create a file with an exact name.
  • Fortinet released patches the week before publication, but the article does not provide the fixed versions.

Article Details

Vulnerability Types
  • Path traversal
  • Null-byte injection
  • Arbitrary file write leading to remote code execution
Severity
Critical (CVSS 9.4)
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1059.004 · Unix ShellThe described overwrite can replace redishb.sh, a shell script run by a cron job, with attacker-controlled content.T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker can exploit the flaw in the FortiSIEM gRPC service to achieve remote code execution.

CVE

CVE-2026-106173The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.

People

Zach HanleyChief Attack Engineer at Horizon3.ai; described how the flaw can overwrite an existing file or create a new one.

Vendors

FortinetCybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

Products

FortiSIEMCybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

Tools

Horizon3.aiAccording to Horizon3.ai, the issue involves an unauthenticated attacker connecting to the gRPC service listening on TCP port 27918 and exploiting the flaw to overwrite an existing file outside of the intended directory

Related Articles