Fortinet says an unauthenticated attacker may run code or commands with specially crafted packets. Fortinet lists FortiSIEM 7.5.0 as affected and 7.5.1 or above as the fix.
What it allows
Fortinet's advisory FG-IR-26-180 is titled "Arbitrary file write in grpc phQueryMaster". It describes a path traversal flaw (CWE-22) that may let an unauthenticated attacker run unauthorized code or commands through specially crafted packets. Fortinet rates it Critical with a CVSSv3 score of 9.4. Its own team found the flaw. The same weakness class (CWE-22) sits behind the Adobe ColdFusion path traversal CVE-2026-48282, a CVSS 10.0 flaw that CISA lists in KEV.
Horizon3.ai, a security company, published its own analysis on 20 October 2026. It says the phQueryMaster service binds tcp/27918 and runs a gRPC server with a service named phoenixSvc. The server does not ask clients for a certificate, so in Horizon3.ai's words "any remote client can connect to the gRPC service on port tcp/27918 unauthenticated". The company says the flaw lets an attacker write data outside the intended directory, which Fortinet rates as able to lead to code execution.
Our FortiSIEM vulnerability news post turns this into a short list of actions.
What Our Checks Showed
- Public proof of concept (GitHub)YesSix repositories for the CVE id by 26 October. The first, from the Horizon3.ai organisation, was created 20 October at 12:29 UTC and had 34 stars and 11 forks on 28 October. One created 22 October calls itself a toolkit with an exploit and a checker. One created 25 October bundles exploits for three20-26 Oct
- Posts on XYesAt least 105 unique public posts (our search hit its cap), 20 October the busiest day in what we collected. The Horizon3.ai attack team announced its deep-dive at 12:52 UTC; Italy's national CSIRT said on 21 October that a proof of concept is available online13-24 Oct
- Dark web (Blackhole)Unknown12 posts mention the CVE id and 20 mention FortiSIEM, nearly all in Telegram channels that share tools, news or CVE feeds, plus a Russian-language forum repost; not verified13-24 Oct
- Government warning (Canada)YesThe Canadian Centre for Cyber Security updated its Fortinet advisory AV26-1037 on 23 October to say that open-source reporting indicates exploitation in the wild. It gives no detail and Fortinet has not confirmed it23 Oct
Fortinet published another critical advisory on 13 October, the same day as FG-IR-26-180. Our page on the FortiSandbox authentication bypass CVE-2026-107656 covers it.
Who is affected
Fortinet's advisory lists FortiSIEM 7.5.0 as affected and says to upgrade to 7.5.1 or above. It lists FortiSIEM 7.6 as not affected, and says FortiSIEM Cloud is not affected.
The NVD record differs. Fortinet supplied its data. The description names FortiSIEM 7.5.0, but the affected-version list also holds 7.0.0 to 7.0.4, 7.1.0 to 7.1.9, 7.2.0 to 7.2.7, 7.3.0 to 7.3.5 and 7.4.0 to 7.4.2. When we read it on 24 October the record was still marked Awaiting Analysis. Sources differ, so an older 7.x release is not proven safe by the advisory alone.
Score Differences
The advisory gives a CVSSv3 score of 9.4. NVD shows a CVSS 3.1 base score of 9.8 for the same flaw, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as supplied by Fortinet.
Exploitation Entries
The advisory says Known Exploited: No and Virtual Patch: No. The NVD record carries a CISA Coordinator SSVC entry dated 13 October 2026 with exploitation "poc", automatable "yes" and technical impact "total". The flaw was not in the CISA Known Exploited Vulnerabilities (KEV) catalog in its 27 October 2026 release.
The Canadian Centre for Cyber Security updated its Fortinet advisory AV26-1037 on 23 October 2026. It says open-source reporting indicates that CVE-2026-106173 is being exploited in the wild. It names no victim and gives no detail. When we read Fortinet's advisory again on 28 October it still said Known Exploited: No.
Timeline
- 13 Oct 2026
Fortinet publishes advisory FG-IR-26-180, rated Critical, and the CVE record appears in NVD the same day. The advisory says Known Exploited: No.
- 20 Oct 2026
Horizon3.ai publishes a deep-dive and a proof of concept repository (created 12:29 UTC) and announces it on X at 12:52 UTC.
- 21 Oct 2026
NVD modifies the CVE record. Italy's national CSIRT posts on X that a proof of concept is available online.
- 22 Oct 2026
A further public repository appears that describes itself as an exploit toolkit with a checker.
- 23 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 23 Oct 2026
The Canadian Centre for Cyber Security updates its Fortinet advisory AV26-1037 to say that open-source reporting indicates CVE-2026-106173 is being exploited in the wild. It names no victim and gives no detail.
- 25 Oct 2026
A public repository appears that bundles exploits for three Fortinet flaws and claims full exploits. A repository that calls itself a reimplementation of the Horizon3.ai proof of concept follows on 26 October.
What to do
-
Check the version
Find the FortiSIEM version your console reports. Fortinet lists 7.5.0 as affected. For an older 7.x release, treat it as possibly affected because the NVD record lists those versions.
-
Restrict tcp port 27918
Fortinet's workaround is to restrict access to tcp port 27918. Allow it only from hosts that must reach it, then test from outside your network that it no longer answers.
-
Upgrade
Move 7.5.0 to 7.5.1 or above. Fortinet lists 7.6 as not affected and FortiSIEM Cloud as not affected.
-
Look for changed files
Horizon3.ai says it found no application logs that reveal exploitation. It advises comparing the modified times of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool with the files around them.
-
Check your exposure
Look for tcp 27918 on any public address in your external attack surface scan, and close it where it appears.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Which FortiSIEM versions does CVE-2026-106173 affect?
Fortinet's advisory lists FortiSIEM 7.5.0 and says 7.6 is not affected. The NVD record also lists 7.0.0 to 7.4.2 as affected. Sources differ.
What fixes CVE-2026-106173?
Fortinet says to upgrade to FortiSIEM 7.5.1 or above. Its workaround is to restrict access to tcp port 27918.
Does it affect FortiSIEM Cloud?
Fortinet's advisory says FortiSIEM Cloud is not affected.
Is public exploit code available?
Horizon3.ai published a proof of concept and a technical analysis on 20 October 2026, and more repositories followed. We have not run any of it.
Is CVE-2026-106173 on the CISA KEV list?
It was not in the catalog release of 27 October 2026. Fortinet's advisory says Known Exploited: No, but the Canadian Centre for Cyber Security cites open-source reports of exploitation (23 October).
Why is the score 9.4 in one place and 9.8 in another?
The advisory gives CVSSv3 9.4. NVD shows a CVSS 3.1 base score of 9.8 from Fortinet's vector. We do not know why the two differ.
Sources
- FG-IR-26-180: Arbitrary file write in grpc phQueryMasterFortinet PSIRT
- CVE-2026-106173NVD
- CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCEHorizon3.ai
- Known Exploited Vulnerabilities catalogCISA
- CWE-22: Improper Limitation of a Pathname to a Restricted DirectoryMITRE
- Fortinet security advisory AV26-1037, Update 1Canadian Centre for Cyber Security
