Public PoC Exploit Released for Critical FortiSIEM Flaw Enabling Unauthenticated RCE

PoC Published for CVE-2026-106173

Cybersecurity researchers at Horizon3.ai have released a proof-of-concept (PoC) exploit for a recently patched critical vulnerability in Fortinet FortiSIEM. Tracked as CVE-2026-106173 and carrying a CVSS score of 9.4, the flaw enables unauthenticated remote code execution through specially crafted packets.

Fortinet released patches for the vulnerability last week. According to the vendor's advisory, FortiSIEM 7.5.0 is affected and should be upgraded to 7.5.1 or above, while FortiSIEM 7.6 is not impacted by this issue.

Technical Breakdown

The vulnerability resides in the FortiSIEM gRPC QueryResultReq handler, which processes untrusted metadata without proper path validation. An unauthenticated attacker connects to the gRPC service listening on TCP port 27918 and exploits the flaw to overwrite files outside the intended directory, converting an arbitrary-file-write primitive into full remote code execution.

The root cause is unsafe path construction in a function named SendQueryResult(), which passes a user-supplied query-id parameter without sufficient validation. Attackers can include directory traversal sequences such as ../ to escape the intended directory. However, the program automatically appends a server-controlled file name suffix (result-<source IP>-0-0-<id>.dat), limiting where the write lands.

A second weakness overcomes this limitation. By embedding a null byte (\0) in the query-id parameter, the operating system treats it as a string terminator and discards everything after it, including the appended suffix. An attacker can craft a query-id like ../../../../../opt/charting/redishb.sh\0... to write to an exact file path in place, preserving original ownership and permissions. A variant using two requests can create a new file with a precise name.

Exploitation Path

Horizon3.ai's Zach Hanley, Chief Attack Engineer, explained that the write lands on the exact path preceding the null byte. When pointed at an existing file, it overwrites that file in place while keeping the original owner and permissions.

The demonstrated attack targets a shell script that performs health checks on the Redis service and runs every 60 seconds via a cron job. By overwriting this script with malicious content, an attacker achieves code execution when the cron job runs.

Recommendations

Organizations running affected FortiSIEM versions should apply the vendor patches immediately. Given the availability of a public PoC, exploitation attempts are likely to follow. Network segmentation and monitoring of gRPC traffic on port 27918 may provide additional defensive layers.

Sources: The Hacker News