Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Fortinet FortiSIEM critical path traversal flaw gets public exploit PoC for RCE.
A critical path traversal vulnerability in Fortinet FortiSIEM, tracked as CVE-2026-106173, has a public proof-of-concept exploit available. The flaw allows unauthenticated attackers to achieve remote code execution by overwriting critical system files, such as a health check script, via crafted packets exploiting gRPC services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical path traversal vulnerability in Fortinet FortiSIEM (CVE-2026-106173) allows unauthenticated attackers to achieve remote code execution by overwriting system files through crafted packets targeting gRPC services. The availability of a public proof-of-concept exploit dramatically lowers the bar for attackers, meaning even less-skilled threat actors can now weaponize this flaw. Security monitoring infrastructure like SIEM platforms is a particularly high-value target because compromising it can blind defenders to ongoing attacks. Organizations running unpatched FortiSIEM instances are now at acute risk of full system compromise with no authentication required.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-106173