{"slug":"fortisiem-cve-2026-106173","title":"FortiSIEM path traversal RCE (CVE-2026-106173)","shortName":"FortiSIEM","summary":"Unauthenticated path traversal in FortiSIEM that Fortinet says may allow code or command execution via crafted packets. FG-IR-26-180 names only 7.5.0 as affected; the fix is 7.5.1 or later. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Workaround: restrict TCP/27918. Reported exploited in the wild (Cyber Centre, 23 Oct 2026). Fortinet says not known exploited (13 Oct 2026). Not in CISA KEV (checked 25 Oct 2026).","isExample":false,"draft":false,"family":"fortisiem-cve-2026-106173","kind":"single-product","aliases":["CVE-2026-106173","FG-IR-26-180","FortiSIEM"],"publishedAt":"2026-10-13","updatedAt":"2026-10-25","patchStatus":"patched","exploited":"reported","scores":{"cve":"CVE-2026-106173","cvss":{"cve":"CVE-2026-106173","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","sourceDate":"2026-10-21","checkedDate":"2026-10-25"},"epss":{"cve":"CVE-2026-106173","score":0.00459,"percentile":0.38844,"date":"2026-10-24","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106173","checkedDate":"2026-10-25"},"kev":{"cve":"CVE-2026-106173","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-25"},"addedDate":"2026-10-25"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated path traversal in FortiSIEM (CVE-2026-106173) that Fortinet says can execute unauthorized code or commands. NVD republishes the Fortinet CNA CVSS 9.8. Reported exploited in the wild (Cyber Centre, 23 Oct 2026). Fortinet advisory says not known exploited (13 Oct 2026). Not in CISA KEV (checked 25 Oct 2026).","action":"Upgrade FortiSIEM 7.5.0 to 7.5.1 or later, or restrict TCP/27918 until you can. FortiSIEM 7.6 and FortiSIEM Cloud are not affected, per Fortinet. If 7.5.0 was reachable, review file timestamps on the two paths Horizon3 named."},"seenInTheWild":[{"metric":"third-party-stated","value":"Open-source reporting indicates that CVE-2026-106173 is being exploited in the wild","observer":"Canadian Centre for Cyber Security","date":"2026-10-23","method":"AV26-1037 Update 1. Names no observing party.","sourceUrl":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037"},{"metric":"vendor-stated","value":"Known Exploited: No","observer":"Fortinet","date":"2026-10-13","method":"FG-IR-26-180 metadata at initial publication.","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-25","items":[{"text":"New catalog page for FortiSIEM unauthenticated path traversal (CVE-2026-106173).","headline":"New catalog page for FortiSIEM CVE-2026-106173","section":"overview","date":"2026-10-25","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-25","kind":"page"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","headline":"Added Act-now priority with sourced CVSS, EPSS, and CISA KEV dates","section":"priority","date":"2026-10-25","addedDate":"2026-10-25","kind":"page"},{"text":"Detection coverage table and JSON, IOC CSV, and STIX feeds.","headline":"Added detection coverage table and JSON, IOC CSV, and STIX feeds","section":"detection","date":"2026-10-25","addedDate":"2026-10-25","kind":"page"}]},"whatTheBugIs":"CVE-2026-106173 is a path traversal (CWE-22) in Fortinet FortiSIEM. Fortinet FG-IR-26-180 (13 Oct 2026) says an unauthenticated attacker may execute unauthorized code or commands via specially crafted packets.\n\nThe Fortinet version table names only FortiSIEM 7.5.0 as affected, with the fix 7.5.1 or above. FortiSIEM 7.6 is listed as not affected. Fortinet states FortiSIEM Cloud is not affected. The advisory workaround is to restrict access on TCP port 27918. Fortinet lists Known Exploited as No, Virtual Patch as No, and CVSSv3 Score 9.4. The NVD record (last modified 21 Oct 2026, checked 25 Oct 2026) is still Awaiting Analysis and republishes a Fortinet CNA CVSS 3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This page stores the NVD CNA metric and keeps the advisory 9.4 figure dated. Fortinet credits internal discovery by Gwendal Guégniaud of the Fortinet Product Security team.\n\nHorizon3 (Zach Hanley, 20 Oct 2026) describes an unauthenticated gRPC service on TCP/27918 that can write a file outside the intended directory and reports that this file write can lead to remote code execution. This page does not republish exploit details. Horizon3 says it did not find application logs that would explicitly reveal exploitation, and names two files whose write or modified timestamps are of interest if a periodically executed script was overwritten.\n\nExploitation status: reported exploited in the wild (Cyber Centre, 23 Oct 2026); Fortinet advisory says not known exploited (13 Oct 2026); not in CISA KEV (checked 25 Oct 2026). Cyber Centre names no observing party. These claims are shown dated and are not resolved on this page.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"TCP/27918 reachability","detail":"Unauthenticated network access to an affected FortiSIEM listener on TCP/27918."},{"id":"unsafe","label":"Path traversal write","detail":"A crafted request writes a file outside the intended directory (CWE-22). Conceptual impact class only."},{"id":"exec","label":"Code execution","detail":"Fortinet says this can execute unauthorized code or commands. Horizon3 reports file write leading to RCE."},{"id":"persist","label":"Optional host follow-on","detail":"Horizon3 names one periodically executed script (/opt/charting/redishb.sh) as its lab path to code execution."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-23","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 25 Oct 2026) against catalog 2026.10.23 (released 2026-10-23T19:30:18Z, 1,756 entries). CVE-2026-106173 is not listed. The NVD record (lastModified 21 Oct 2026) includes a CISA Coordinator SSVC option exploitation: poc; that is not a KEV listing."},"firstSeen":{"date":"2026-10-23","source":"Canadian Centre for Cyber Security","note":"Reported exploited in the wild (Cyber Centre, 23 Oct 2026). Fortinet advisory says not known exploited (13 Oct 2026). Not in CISA KEV (checked 25 Oct 2026). Cyber Centre names no observing party. These claims are not resolved on this page. First calendar day of exploitation: not verified."},"vendorStatements":[{"vendor":"Fortinet","date":"2026-10-13","statement":"Known Exploited: No. An Improper limitation of a pathname to a restricted directory (path traversal) [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Workaround: Restricting access on tcp port 27918 prevents the issue. FortiSIEM Cloud is NOT affected by this vulnerability.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","retracted":false},{"vendor":"Canadian Centre for Cyber Security","date":"2026-10-23","statement":"Open-source reporting indicates that CVE-2026-106173 is being exploited in the wild.","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","retracted":false}]},"timeline":[{"date":"2026-10-13","event":"Fortinet published FG-IR-26-180 for CVE-2026-106173. Unauthenticated path traversal may allow code or command execution. Affected: FortiSIEM 7.5.0. Fix: 7.5.1 or above. FortiSIEM 7.6 and FortiSIEM Cloud not affected. Workaround: restrict TCP/27918. Known Exploited: No. CVSSv3 Score 9.4.","source":{"title":"FG-IR-26-180","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","publisher":"Fortinet"},"kind":"advisory","key":true,"addedDate":"2026-10-25"},{"date":"2026-10-13T18:17:14.697Z","event":"NVD published CVE-2026-106173 at 18:17 UTC. Status when we opened the record on 25 Oct 2026: Awaiting Analysis. CNA Fortinet metric on that record is CVSS 3.1 9.8.","source":{"title":"NVD - CVE-2026-106173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-25"},{"date":"2026-10-13","event":"Canadian Centre for Cyber Security published AV26-1037 covering several Fortinet products, including FortiSIEM prior to 7.5.1.","source":{"title":"Fortinet security advisory (AV26-1037)","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","publisher":"Canadian Centre for Cyber Security"},"kind":"advisory","addedDate":"2026-10-25"},{"date":"2026-10-20","event":"Horizon3 published a defender-facing deep dive and public PoC: unauthenticated gRPC on TCP/27918, path traversal file write, researcher-reported RCE. Independent validation: not verified.","source":{"title":"CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","publisher":"Horizon3.ai"},"kind":"poc","key":true,"addedDate":"2026-10-25"},{"date":"2026-10-21","event":"NVD last modified CVE-2026-106173 (04:17 UTC). The record republishes the Fortinet CNA 9.8 metric and adds a reference to github.com/horizon3ai/CVE-2026-106173.","source":{"title":"NVD - CVE-2026-106173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-25"},{"date":"2026-10-22","event":"CSA Singapore published AL-2026-153: FortiSIEM 7.5.0 affected, upgrade to 7.5.1 or later, CVSS 9.8, and a public proof of concept is available. It does not state in-the-wild exploitation.","source":{"title":"Critical Vulnerability in Fortinet FortiSIEM (AL-2026-153)","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-153/","publisher":"Cyber Security Agency of Singapore"},"kind":"advisory","addedDate":"2026-10-25"},{"date":"2026-10-23","event":"Canadian Centre for Cyber Security Update 1: open-source reporting indicates CVE-2026-106173 is being exploited in the wild. No observing party is named.","source":{"title":"Fortinet security advisory (AV26-1037) Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","publisher":"Canadian Centre for Cyber Security"},"kind":"exploited","key":true,"addedDate":"2026-10-25"}],"openNotes":[{"title":"Fortinet advisory 9.4 versus NVD CNA 9.8","detail":"FG-IR-26-180 shows CVSSv3 Score 9.4. The NVD API record we fetched on 25 Oct 2026 (lastModified 21 Oct 2026) republishes a Fortinet CNA CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD has no NVD-produced metric yet (Awaiting Analysis). This page stores the NVD CNA 9.8 figure per the method page and keeps the advisory 9.4 figure dated. The two numbers are not resolved here.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","date":"2026-10-21","publisher":"NVD"}]},{"title":"NVD CNA version list is wider than the FG-IR-26-180 table","detail":"The FG-IR-26-180 HTML table names FortiSIEM 7.5.0 as the only affected build and FortiSIEM 7.6 as not affected. The NVD record (source psirt@fortinet.com) also lists affected ranges 7.4.0 through 7.4.2, 7.3.0 through 7.3.5, 7.2.0 through 7.2.7, 7.1.0 through 7.1.9, and 7.0.0 through 7.0.4. Cyber Centre AV26-1037 writes FortiSIEM prior to 7.5.1. This page follows the Fortinet advisory table for the version rows. The extra NVD CNA ranges are not verified against a matching FG-IR table row.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","date":"2026-10-21","publisher":"NVD"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","date":"2026-10-23","publisher":"Canadian Centre for Cyber Security"}]},{"title":"In-the-wild claims conflict","detail":"Reported exploited in the wild (Cyber Centre, 23 Oct 2026). Fortinet advisory says not known exploited (13 Oct 2026). Not in CISA KEV (checked 25 Oct 2026). Cyber Centre names no observing party. Independent validation of in-the-wild use: not verified.","sources":[{"url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","date":"2026-10-23","publisher":"Canadian Centre for Cyber Security"},{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-23","publisher":"CISA"}]}],"defenderActions":[{"title":"Inventory FortiSIEM 7.5.0 and TCP/27918 reachability","detail":"Find every FortiSIEM 7.5.0 host, including staging. FG-IR-26-180: only 7.5.0 is in the affected column. Record whether untrusted networks can reach TCP/27918. FortiSIEM 7.6 and FortiSIEM Cloud need no customer patch, per Fortinet.","priority":"now","links":[{"label":"FG-IR-26-180","href":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180"}]},{"title":"Upgrade 7.5.0 to 7.5.1 or later, or restrict TCP/27918","detail":"Fortinet: upgrade FortiSIEM 7.5 to 7.5.1 or above. If you cannot patch yet, restricting access on TCP port 27918 prevents the issue. Virtual Patch: No.","priority":"now","links":[{"label":"FG-IR-26-180","href":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180"}]},{"title":"If 7.5.0 was reachable, review file timestamps Horizon3 named","detail":"Horizon3 (20 Oct 2026) found no application logs that would explicitly reveal this bug was used. It tells defenders to inspect write or modified timestamps, especially /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool. Independent validation: not verified. No published network IOCs from a source we opened.","priority":"now","links":[{"label":"Horizon3 deep dive (for defenders)","href":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/"}]}],"detection":[{"title":"Review inbound connections to TCP/27918","detail":"Generic defensive pointer from the Fortinet workaround. FG-IR-26-180: restricting access on TCP port 27918 prevents the issue. Review firewall, flow, or host-socket logs for inbound sessions to TCP/27918 on FortiSIEM hosts. This is not a vendor detection signature. No published network IOCs.","logSource":"Firewall / network flow logs, or host socket inventory, for TCP/27918","kind":"generic","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13"},{"title":"Inspect write or modified timestamps on Horizon3-named files","detail":"Horizon3 (20 Oct 2026): it did not find application logs that would explicitly reveal this vulnerability was exploited. If a periodically executed script was overwritten, inspect file write or modified timestamps that do not match surrounding files. Files of particular interest: /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool. Independent validation: not verified. No invented IOCs.","logSource":"FortiSIEM host filesystem metadata (mtime/ctime on named paths)","kind":"generic","group":"edr","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20"},{"title":"FortiSIEM application logs: no explicit exploit signal in the sources we opened","detail":"Horizon3: we did not find any application logs that would explicitly reveal that this vulnerability was exploited. Fortinet published no log signature and Virtual Patch is No. Treat absence of an application-log hit as no statement yet, not as clearance.","logSource":"FortiSIEM application logs","kind":"generic","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20"}],"detectionLinks":[{"title":"CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","author":"Zach Hanley, Horizon3.ai","date":"2026-10-20","note":"Public analysis and PoC for defenders. File-timestamp hunting only. No application-log detector. This site does not republish exploit code."}],"retrohunt":{"summary":"If FortiSIEM 7.5.0 was reachable on TCP/27918, hunt from 13 Oct 2026 in network flows to that port and in filesystem timestamps on the two paths Horizon3 named. Horizon3 found no application logs that would explicitly reveal this bug was used.","lookback":{"from":"2026-10-13","basis":"public-disclosure","rationale":"Fortinet published FG-IR-26-180 on 13 Oct 2026. Horizon3 published a public PoC on 20 Oct 2026. No sourced first-exploitation calendar day exists. Hunt from the public disclosure.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"}]},"logSources":[{"name":"Firewall / network flow logs for TCP/27918","why":"Fortinet workaround: restricting access on TCP port 27918 prevents the issue. Review inbound reachability, not exploit payloads.","required":true},{"name":"FortiSIEM host filesystem metadata","why":"Horizon3: inspect write or modified timestamps, especially /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool.","required":true},{"name":"FortiSIEM application logs","why":"Horizon3 found no application logs that would explicitly reveal exploitation. Keep them if you already collect them. Absence is no statement yet, not clearance.","required":false}],"steps":[{"title":"List inbound sessions to TCP/27918 since 13 Oct 2026","detail":"Search firewall or flow logs for connections to FortiSIEM hosts on TCP/27918. This is generic defensive review from the Fortinet workaround. No published attacker IPs.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]},{"title":"Compare timestamps on the two Horizon3-named files","detail":"Horizon3: if a periodically executed script was overwritten, inspect write or modified timestamps that do not match surrounding files. Files of particular interest: /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool.","sources":[{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"}]}],"queries":[],"artefacts":[{"kind":"file","value":"/opt/charting/redishb.sh","detail":"Horizon3 file of particular interest if a periodically executed script was overwritten. Researcher-reported lab path, not an in-the-wild observation.","sourceUrl":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","sourceDate":"2026-10-20"},{"kind":"file","value":"/opt/phoenix/bin/phLicenseTool","detail":"Horizon3 file of particular interest for timestamp review. Researcher-reported, not an in-the-wild observation.","sourceUrl":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","sourceDate":"2026-10-20"},{"kind":"network","value":"Inbound TCP/27918 to a FortiSIEM host","detail":"Fortinet workaround port. Presence of a session is reachability, not proof of exploitation.","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","sourceDate":"2026-10-13"}],"iocNote":"No published network IOCs from a source we opened as of 25 Oct 2026. Do not invent IPs, hashes, or user-agents.","hitMeaning":[{"level":"attempt","detail":"Inbound TCP/27918 from an untrusted network, with no unexpected file timestamp on the Horizon3-named paths."},{"level":"likely-compromise","detail":"A write or modified timestamp on /opt/charting/redishb.sh or /opt/phoenix/bin/phLicenseTool that does not match surrounding files, after 13 Oct 2026, on a 7.5.0 host that was reachable on TCP/27918."},{"level":"compromise","detail":"Evidence that attacker-controlled code ran on the FortiSIEM host. No sourced in-the-wild procedure was published in the sources we opened. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Restrict TCP/27918 and upgrade to 7.5.1 or later","detail":"Fortinet: restricting access on TCP port 27918 prevents the issue. The fix is 7.5.1 or above.","links":[{"label":"FG-IR-26-180","href":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180"}]},{"title":"Preserve copies and timestamps of the named files","detail":"Keep the original /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool, plus their timestamps, before any restore or upgrade overwrites them.","links":[{"label":"Horizon3 deep dive","href":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/"}]}],"limits":["Horizon3 found no application logs that would explicitly reveal this vulnerability was exploited.","No published network IOCs. A TCP/27918 session is reachability, not compromise.","The two file paths are Horizon3 files of interest from lab work, not observed in-the-wild persistence.","First calendar day of exploitation: not verified."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"}],"updatedAt":"2026-10-25"},"amIAffected":{"summary":"FortiSIEM 7.5.0 is the only build in the FG-IR-26-180 affected column, when TCP/27918 is reachable. The fix is 7.5.1 or later. FortiSIEM 7.6 and FortiSIEM Cloud are not affected, per Fortinet. No public CLI or GUI version-string was copied from FG-IR-26-180 in this pass.","checks":[{"id":"v2s-aia-fortisiem-cve-2026-106173-version-1","kind":"version","title":"Record the FortiSIEM software version against FG-IR-26-180","detail":"FG-IR-26-180: FortiSIEM 7.5.0 is affected; upgrade to 7.5.1 or above. FortiSIEM 7.6 is not affected. FortiSIEM Cloud is not affected. No public CLI version string was copied from FG-IR-26-180 in this pass. Use the product's own version display.","command":"Record the installed FortiSIEM version from the product's own version display and compare it to FG-IR-26-180 (affected 7.5.0; fix 7.5.1 or above; 7.6 not affected).","affectedMeans":"The installed version is FortiSIEM 7.5.0.","fixedMeans":"The installed version is FortiSIEM 7.5.1 or later on the 7.5 train, or the product is FortiSIEM 7.6, or the deployment is FortiSIEM Cloud (Fortinet: not affected).","notes":"This is inventory only. The NVD CNA record lists extra 7.0 through 7.4 ranges that the FG-IR-26-180 table does not; those ranges are not verified against the advisory table.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]},{"id":"v2s-aia-fortisiem-cve-2026-106173-config-2","kind":"config","title":"Record whether TCP/27918 is reachable from untrusted networks","detail":"FG-IR-26-180 workaround: restricting access on TCP port 27918 prevents the issue. On each FortiSIEM 7.5.0 host, record whether that port is listening and whether untrusted networks can reach it. Do not send crafted packets.","command":"On each FortiSIEM host, record whether TCP/27918 is listening and whether it is reachable from untrusted networks.","affectedMeans":"FortiSIEM 7.5.0 and TCP/27918 is reachable from an untrusted network.","fixedMeans":"TCP/27918 is not reachable from untrusted networks, or the host is on 7.5.1 or later, or the product is FortiSIEM 7.6 or FortiSIEM Cloud.","notes":"Reachability is a precondition, not proof of compromise.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]}],"limits":["No sourced Shodan or Censys fingerprint for this CVE. Do not invent one.","No public CLI version string was copied from FG-IR-26-180.","NVD CNA extra 7.0 through 7.4 ranges: not verified against the FG-IR-26-180 table."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}],"updatedAt":"2026-10-25","addedDate":"2026-10-25"},"mitigations":{"summary":"Fortinet documents one workaround: restrict access on TCP port 27918. That prevents the issue until 7.5.0 is upgraded to 7.5.1 or later. Virtual Patch: No.","items":[{"title":"Restrict access on TCP port 27918","detail":"FG-IR-26-180 workaround: restricting access on TCP port 27918 prevents the issue. Apply this on every FortiSIEM 7.5.0 host that you cannot upgrade immediately.","limits":"Not a software fix. Still upgrade 7.5.0 to 7.5.1 or later. Fortinet lists Virtual Patch as No. FortiSIEM 7.6 and FortiSIEM Cloud are already not affected, per Fortinet, so this workaround is for 7.5.0 only.","verify":"Untrusted networks can no longer complete a TCP connection to port 27918 on the FortiSIEM host. Confirm in your firewall or host ACL, then re-check after the next change window.","source":{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}}],"updatedAt":"2026-10-25","addedDate":"2026-10-25"},"response":{"summary":"Restrict TCP/27918 and upgrade FortiSIEM 7.5.0 to 7.5.1 or later. If the host was reachable while on 7.5.0, preserve filesystem timestamps for the two paths Horizon3 named. No sourced in-the-wild persistence list exists beyond that researcher note.","containment":[{"title":"Restrict TCP/27918 if you cannot patch immediately","detail":"FG-IR-26-180: restricting access on TCP port 27918 prevents the issue.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]},{"title":"Upgrade FortiSIEM 7.5.0 to 7.5.1 or later","detail":"FG-IR-26-180: upgrade to 7.5.1 or above. FortiSIEM 7.6 and FortiSIEM Cloud need no customer patch, per Fortinet. An upgrade does not replace timestamp review if the host was reachable while vulnerable.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]},{"title":"Review timestamps on the two Horizon3-named files before trusting the host","detail":"Horizon3 (20 Oct 2026): inspect write or modified timestamps that do not match surrounding files, especially /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool. Researcher files of interest, not an in-the-wild observation. Independent validation: not verified.","sources":[{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"}]}],"rotate":[{"item":"Credentials, API keys, and secrets the FortiSIEM host could reach","reason":"General: if unauthenticated code execution succeeded, treat secrets on or behind the host as exposed. No CVE-2026-106173-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]}],"persistence":[{"kind":"path","value":"/opt/charting/redishb.sh","detail":"Horizon3 file of particular interest if a periodically executed script was overwritten. Researcher-reported lab path, not observed in-the-wild persistence.","sourceUrl":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","sourceDate":"2026-10-20"},{"kind":"cron","value":"/opt/charting/redishb.sh invoked on a short interval","detail":"Horizon3 says this script is invoked every 60 seconds by a cron job in the environment they inspected. Researcher-reported, not an in-the-wild observation.","sourceUrl":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","sourceDate":"2026-10-20"},{"kind":"path","value":"/opt/phoenix/bin/phLicenseTool","detail":"Horizon3 file of particular interest for timestamp review. Researcher-reported, not observed in-the-wild persistence.","sourceUrl":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","sourceDate":"2026-10-20"}],"evidence":[{"title":"Installed FortiSIEM version string from before the upgrade","detail":"Preserve the version you recorded against FG-IR-26-180 so you can show whether the host was 7.5.0 while TCP/27918 was reachable.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]},{"title":"Copies and timestamps of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool","detail":"Horizon3: inspect write or modified timestamps. Keep the files and their metadata from 13 Oct 2026 onward before restore or upgrade.","sources":[{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"Firewall or flow logs for TCP/27918 from 13 Oct 2026","detail":"Keep inbound session records to TCP/27918. No published attacker IPs. A session is reachability, not proof of exploitation.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"}]}],"limits":["Horizon3 found no application logs that would explicitly reveal this vulnerability was exploited.","No published network IOCs from a source we opened.","The two file paths are Horizon3 files of interest, not a vendor persistence bulletin.","In-the-wild use is disputed: Cyber Centre 23 Oct 2026 versus Fortinet Known Exploited No on 13 Oct 2026. Not in CISA KEV (checked 25 Oct 2026)."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","publisher":"Fortinet"},{"url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","publisher":"Horizon3.ai"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","date":"2026-10-23","publisher":"Canadian Centre for Cyber Security"}],"updatedAt":"2026-10-25","addedDate":"2026-10-25"},"bulletins":[{"vendor":"Fortinet","title":"FG-IR-26-180 FortiSIEM path traversal (CVE-2026-106173)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","cve":"CVE-2026-106173"}],"coverage":[{"title":"FG-IR-26-180","publisher":"Fortinet","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","date":"2026-10-13","type":"vendor","addedDate":"2026-10-25"},{"title":"Fortinet security advisory (AV26-1037) Update 1","publisher":"Canadian Centre for Cyber Security","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","date":"2026-10-23","type":"government","addedDate":"2026-10-25"},{"title":"CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE","publisher":"Horizon3.ai (Zach Hanley)","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","date":"2026-10-20","type":"research","addedDate":"2026-10-25"},{"title":"Critical Vulnerability in Fortinet FortiSIEM (AL-2026-153)","publisher":"Cyber Security Agency of Singapore","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-153/","date":"2026-10-22","type":"government","addedDate":"2026-10-25"},{"title":"NVD CVE-2026-106173","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","date":"2026-10-13","type":"government","addedDate":"2026-10-25"}],"posts":[],"research":[{"title":"FG-IR-26-180","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","authors":"Fortinet (credit: Gwendal Guégniaud, Fortinet Product Security)","date":"13 Oct 2026"},{"title":"CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","authors":"Zach Hanley, Horizon3.ai","date":"20 Oct 2026"},{"title":"NVD CVE-2026-106173 (CNA Fortinet; Awaiting Analysis)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","authors":"NVD / Fortinet PSIRT","date":"lastModified 21 Oct 2026, checked 25 Oct 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-106173 not listed; catalog 2026.10.23)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.23, checked 25 Oct 2026"}],"impact":{"kind":"single-product","product":"Fortinet FortiSIEM","versions":[{"version":"FortiSIEM 7.5.0","status":"affected","versions":">= 7.5.1","vendorStatement":{"date":"2026-10-13","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","quote":"Table excerpt (FG-IR-26-180). Version: FortiSIEM 7.5. Affected: 7.5.0. Solution: Upgrade to 7.5.1 or above."},"statusLabel":"Affected when TCP/27918 is reachable","addedDate":"2026-10-25"},{"version":"FortiSIEM 7.6","status":"vendor-stated-not-affected","versions":"Not applicable (vendor)","vendorStatement":{"date":"2026-10-13","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","quote":"Table excerpt (FG-IR-26-180). Version: FortiSIEM 7.6. Affected: Not affected. Solution: Not Applicable."},"addedDate":"2026-10-25"},{"version":"FortiSIEM Cloud","status":"vendor-stated-not-affected","versions":"Not applicable (vendor: not affected)","vendorStatement":{"date":"2026-10-13","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-180","quote":"FortiSIEM Cloud is NOT affected by this vulnerability."},"addedDate":"2026-10-25"}]},"pocs":[{"title":"Horizon3 deep dive and public PoC (for defenders)","url":"https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/","source":"Zach Hanley, Horizon3.ai","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-20","notes":"researcher reports file write leading to RCE (Horizon3, 20 Oct 2026); independent validation: not verified. Listed for defenders. This site does not republish exploit code. Horizon3 points to a public GitHub repository; NVD also lists https://github.com/horizon3ai/CVE-2026-106173 as of 21 Oct 2026.","addedDate":"2026-10-25"}],"_feed":{"page":"https://vuln2shell.com/vulns/fortisiem-cve-2026-106173","json":"https://vuln2shell.com/vulns/fortisiem-cve-2026-106173.json","iocsCsv":"https://vuln2shell.com/vulns/fortisiem-cve-2026-106173/iocs.csv","stix":"https://vuln2shell.com/vulns/fortisiem-cve-2026-106173/stix.json"}}