Article
FortiSIEM 7.5.0 Flaw: Version Table, Port 27918 and Today’s Checks
Fortinet lists FortiSIEM 7.5.0 for CVE-2026-106173; NVD lists more. See the version table, the 7.5.1 fix, the tcp 27918 workaround and what to check.
Read more
Vulnerability
Fortinet FortiSIEM path traversal (CVE-2026-106173)
A path traversal flaw (CWE-22) in the phQueryMaster gRPC service of Fortinet FortiSIEM.
- CVE ID
- CVE-2026-106173
- CVSS
- 9.4 Critical (CVSSv3, Fortinet advisory); 9.8 Critical (CVSS 3.1, NVD)
- Affected product
- FortiSIEM (phQueryMaster gRPC service, tcp 27918)
- Exploited
- Unknown
- Published
- 13 October 2026
In short
CVE-2026-106173 is a path traversal flaw (CWE-22) in the phQueryMaster gRPC service of Fortinet FortiSIEM. Fortinet says an unauthenticated attacker may run code or commands with specially crafted packets. Fortinet lists FortiSIEM 7.5.0 as affected and 7.5.1 or above as the fix.
- CVECVE-2026-106173
- ProductFortinet FortiSIEM (phQueryMaster gRPC service, tcp 27918)
- Fix Steps5actions listedCheck the version · Restrict tcp port 27918
What it allows
Fortinet's advisory FG-IR-26-180 is titled "Arbitrary file write in grpc phQueryMaster". It describes a path traversal flaw (CWE-22) that may let an unauthenticated attacker run unauthorized code or commands through specially crafted packets. Fortinet rates it Critical with a CVSSv3 score of 9.4. Its own team found the flaw.
Horizon3.ai, a security company, published its own analysis on 20 October 2026. It says the phQueryMaster service binds tcp/27918 and runs a gRPC server with a service named phoenixSvc. The server does not ask clients for a certificate, so in Horizon3.ai's words "any remote client can connect to the gRPC service on port tcp/27918 unauthenticated". The company says the flaw lets an attacker write data outside the intended directory, which Fortinet rates as able to lead to code execution.
Our FortiSIEM vulnerability news post turns this into a short list of actions.
What Our Checks Showed
Exploit signals
- Public proof of concept (GitHub)YesFour repositories for the CVE id. The first, from the Horizon3.ai organisation, was created 20 October at 12:29 UTC; one created 22 October calls itself a toolkit with an exploit and a checker. READMEs read as data, not run, not linked20-23 Oct
- Posts on XYesAt least 105 unique public posts (our search hit its cap), 20 October the busiest day in what we collected. The Horizon3.ai attack team announced its deep-dive at 12:52 UTC; Italy's national CSIRT said on 21 October that a proof of concept is available online13-24 Oct
- Dark web (THANOS)Unknown12 posts mention the CVE id and 20 mention FortiSIEM, nearly all in Telegram channels that share tools, news or CVE feeds, plus a Russian-language forum repost; not verified13-24 Oct
Verdict Public proof of concept, exploitation not confirmed by the vendor
Who is affected
Fortinet's advisory lists FortiSIEM 7.5.0 as affected and says to upgrade to 7.5.1 or above. It lists FortiSIEM 7.6 as not affected, and says FortiSIEM Cloud is not affected.
The NVD record differs. Fortinet supplied its data. The description names FortiSIEM 7.5.0, but the affected-version list also holds 7.0.0 to 7.0.4, 7.1.0 to 7.1.9, 7.2.0 to 7.2.7, 7.3.0 to 7.3.5 and 7.4.0 to 7.4.2. When we read it on 24 October the record was still marked Awaiting Analysis. Sources differ, so an older 7.x release is not proven safe by the advisory alone.
Score Differences
The advisory gives a CVSSv3 score of 9.4. NVD shows a CVSS 3.1 base score of 9.8 for the same flaw, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as supplied by Fortinet.
Exploitation Entries
The advisory says Known Exploited: No and Virtual Patch: No. The NVD record carries a CISA Coordinator SSVC entry dated 13 October 2026 with exploitation "poc", automatable "yes" and technical impact "total". The flaw was not in the CISA Known Exploited Vulnerabilities (KEV) catalog in its 23 October 2026 release.
Timeline
- 13 Oct 2026
Fortinet publishes advisory FG-IR-26-180, rated Critical, and the CVE record appears in NVD the same day. The advisory says Known Exploited: No.
- 20 Oct 2026
Horizon3.ai publishes a deep-dive and a proof of concept repository (created 12:29 UTC) and announces it on X at 12:52 UTC.
- 21 Oct 2026
NVD modifies the CVE record. Italy's national CSIRT posts on X that a proof of concept is available online.
- 22 Oct 2026
A further public repository appears that describes itself as an exploit toolkit with a checker.
- 23 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
What to do
-
Check the version
Find the FortiSIEM version your console reports. Fortinet lists 7.5.0 as affected. For an older 7.x release, treat it as possibly affected because the NVD record lists those versions.
-
Restrict tcp port 27918
Fortinet's workaround is to restrict access to tcp port 27918. Allow it only from hosts that must reach it, then test from outside your network that it no longer answers.
-
Upgrade
Move 7.5.0 to 7.5.1 or above. Fortinet lists 7.6 as not affected and FortiSIEM Cloud as not affected.
-
Look for changed files
Horizon3.ai says it found no application logs that reveal exploitation. It advises comparing the modified times of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool with the files around them.
-
Check your exposure
Look for tcp 27918 on any public address in your external attack surface scan, and close it where it appears.
Questions
Which FortiSIEM versions does CVE-2026-106173 affect?
Fortinet's advisory lists FortiSIEM 7.5.0 and says 7.6 is not affected. The NVD record also lists 7.0.0 to 7.4.2 as affected. Sources differ.
What fixes CVE-2026-106173?
Fortinet says to upgrade to FortiSIEM 7.5.1 or above. Its workaround is to restrict access to tcp port 27918.
Does it affect FortiSIEM Cloud?
Fortinet's advisory says FortiSIEM Cloud is not affected.
Is public exploit code available?
Horizon3.ai published a proof of concept and a technical analysis on 20 October 2026, and more repositories followed. We have not run any of it.
Is CVE-2026-106173 on the CISA KEV list?
It was not in the catalog release of 23 October 2026. Fortinet's advisory says Known Exploited: No.
Why is the score 9.4 in one place and 9.8 in another?
The advisory gives CVSSv3 9.4. NVD shows a CVSS 3.1 base score of 9.8 from Fortinet's vector. We do not know why the two differ.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 74 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.