Fortinet FortiSIEM: Unauthenticated remote code execution (CVE-2026-106173)
A public proof-of-concept exploit is available for CVE-2026-106173, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM.
CVE search metadata
CVE search record: CVE-2026-106173. Severity: critical. CVSS: 9.8. EPSS: 0.46%. KEV: no. Product: FortiSIEM. Brief: Fortinet FortiSIEM: Unauthenticated remote code execution (CVE-2026-106173). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fortisiem-rce/
Triage facts
Revision 1- Applicability
- FortiSIEM
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 23, 17:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-106173 is an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM. The vulnerability exists in the gRPC QueryResultReq handler, which processes untrusted metadata without proper path validation. Attackers can leverage path traversal sequences and NUL-byte injection to write arbitrary files to the filesystem. Publicly available exploit code targets the default gRPC port 27918.