Fortinet FortiSIEM 7.5.0 has a CVSS 9.8 path traversal, CVE-2026-106173, that lets an unauthenticated attacker run code via packets to tcp/27918. Fixed in 7.5.1; not known exploited.
Fortinet has disclosed a critical flaw in FortiSIEM 7.5.0, its security information and event management platform. Tracked as CVE-2026-106173, the bug is a path traversal weakness (CWE-22) that lets a remote, unauthenticated attacker execute unauthorized code or commands by sending specially crafted packets to the product. Fortinet published the advisory, FG-IR-26-180, on 13 October 2026. As of 16 October 2026 the vendor says it is not aware of exploitation, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog (we covered Fortinet's exploited FortiMail flaw and the FortiVoice zero-day earlier).
Who is affected
Fortinet's advisory names FortiSIEM 7.5.0 as affected and lists FortiSIEM 7.6 and FortiSIEM Cloud as not affected. The fix is FortiSIEM 7.5.1 or later. The advisory's table covers only the 7.6 and 7.5 branches; it says nothing about 7.4 and earlier.
One discrepancy is worth flagging. Fortinet's own CVE record, which NVD mirrors, describes 7.5.0 only in its text, but its structured affected-product data also marks the 7.0, 7.1, 7.2, 7.3 and 7.4 release lines (up to 7.4.2) as affected. We could not resolve the difference from public sources. Administrators running older 7.x builds should ask Fortinet or check the live advisory before assuming they are safe.
Severity
NVD shows a CVSS v3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supplied by Fortinet. That means network-reachable, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. NVD had not yet analyzed the record (status "Awaiting Analysis") as of 16 October.
The Fortinet advisory page displays 9.4 instead. That is a temporal score: the same vector with exploit-maturity, remediation-level and report-confidence modifiers (E:H/RL:O/RC:C) applied. Fortinet's own CVE record also scores it 9.4 with the temporal vector. The two numbers describe the same flaw; 9.8 is the base score of that vector, as NVD shows it. The "E:H" modifier is a scoring input and should not be read as evidence of attacks, since the advisory states the flaw is not known to be exploited. CISA's coordinator assessment in the NVD record (14 October) lists exploitation as "none", the flaw as automatable, and technical impact as total. Tenable reports an EPSS value of 0.00433.
Technical detail
Public detail is thin. The advisory is titled "Arbitrary file write in grpc phQueryMaster", which points at a file-write primitive in a FortiSIEM gRPC service. Fortinet's workaround says that restricting access to tcp port 27918 "prevents the issue", which indicates that this is the listener that receives the malicious packets. Fortinet says the flaw was found internally by Gwendal Guégniaud of its Product Security team. We found no public proof of concept or researcher write-up as of 16 October, only aggregator pages that repeat the advisory. Fortinet lists no virtual patch.
Inference, not confirmed by the sources: a path traversal that yields arbitrary file writes can often be turned into code execution by overwriting files that the system later runs. Horizon3.ai described that pattern for an earlier FortiSIEM bug, CVE-2025-64155, where file writes led to root-level code execution. Whether the same applies here has not been published.
Why SIEMs are high-value targets
A SIEM sits at the centre of an organisation's monitoring. It ingests logs from firewalls, servers, identity systems and endpoints, and it often holds credentials or API access for the collectors and devices it manages. An attacker who controls one can read what defenders see, tamper with or delete evidence, and suppress alerts, in addition to gaining a foothold in a trusted network segment. For that reason a pre-authentication remote code execution bug in this class of product deserves fast handling even before exploitation is reported.
What defenders should do
- Identify FortiSIEM deployments and their versions. Upgrade 7.5.0 systems to 7.5.1 or later.
- If you cannot patch immediately, restrict network access to tcp port 27918 to only the hosts that need it, per Fortinet's workaround.
- Check whether tcp/27918 is reachable from untrusted networks, and treat any such exposure as urgent.
- Confirm the status of 7.0 to 7.4 deployments with Fortinet, given the discrepancy above.
- Treat 7.5.1 as the minimum for this CVE. A separate same-day Fortinet advisory, FG-IR-26-183 (CVE-2026-106176), covers missing authorization (CWE-862) in the FortiSIEM GUI that lets an authenticated attacker run unauthorized code or commands through crafted HTTP requests. It is rated Low (3.4 on the PSIRT page, 3.8 base on NVD) and affects all FortiSIEM 7.5 versions, with the remedy "migrate to a fixed release"; 7.6 is not affected. Moving to 7.6 therefore clears both flaws. It is not critical and is not reported exploited.
- Review FortiSIEM hosts for unexpected file changes and unusual connections to tcp/27918, and watch the Fortinet advisory and the CISA KEV catalog for any change in exploitation status.