Canada's Cyber Centre reports active exploitation of FortiSIEM RCE
A critical flaw in FortiSIEM's gRPC QueryResultReq handler allows unauthenticated remote code execution through path traversal and arbitrary file writes. Canada's Cyber Centre reports attackers exploiting CVE-2026-106173, while Fortinet still lists the flaw as not known to be exploited. Update to FortiSIEM 7.5.1 or 7.6.0 or later.
What happened
A flaw in FortiSIEM, Fortinet's security monitoring product, lets attackers run code on the server without credentials or login. Canada's cyber security agency reports the flaw is already being exploited. A public exploit has been released.
Why it matters
FortiSIEM centralizes security logs and alerts; a successful attack gives the attacker full control and can blind the company's incident visibility. Exploitation requires no login and a public exploit exists, which raises the risk.
What to do
Update immediately to FortiSIEM 7.5.1 or 7.6.0 or later. Until the update is done, restrict access to TCP port 27918 (gRPC service) to trusted internal networks only. Review FortiSIEM logs for anomalous activity.
For the technical team
- CVE
- CVE-2026-106173
- Affected
- Fortinet FortiSIEM · FortiSIEM 7.0.0 through 7.5.0, across multiple release branches.
- Exploitation
- Active exploitation reported by Canada's Cyber Centre. Horizon3 released an exploit on Oct 20; a public PoC demonstrates blind command execution. Fortinet still lists the flaw as not known to be exploited.
- Fix
- FortiSIEM 7.5.1 or 7.6.0 and later. Mitigation: restrict exposure of the gRPC service on TCP port 27918.
- Vector
- FortiSIEM gRPC QueryResultReq handler: improper validation of attacker-controlled metadata allows path traversal and arbitrary file writes. Overwriting files later executed by the system chains into remote code execution. Unauthenticated exploitation against the exposed gRPC service on TCP port 27918.
- More details
- CVSS 9.4 (critical) per DarkWebInformer. The PoC demonstrates blind command execution through the arbitrary file-write chain.
Timeline
Canada's Cyber Centre says attackers are exploiting CVE-2026-106173 without login; version 7.5.1 fixes the flaw, though Fortinet still lists it as not known to be exploited.
Incident opened.
Sources 2 sources
- @DarkWebInformer @DarkWebInformer
- @IntCyberDigest @IntCyberDigest
