Researchers at Horizon3.ai have published a proof-of-concept exploit for a critical FortiSIEM vulnerability tracked as CVE-2026-106173. The flaw, rated 9.4 on the CVSS scale, is an unauthenticated path traversal issue in the gRPC service listening on TCP port 27918. An attacker can send specially crafted packets to execute unauthorized code or commands.
The root cause is unsafe path construction in the SendQueryResult() function, where a user-supplied "query-id" parameter is passed without sufficient validation. By combining directory traversal sequences with NUL-byte injection in gRPC's HTTP/2 and HPACK encoding, the attacker can write arbitrary files outside the intended directory. The technique targets an existing shell script, /opt/charting/redishb.sh, which runs every 60 seconds via cron, allowing the overwritten file to be executed with its original owner and permissions.
Fortinet released patches last week, with FortiSIEM 7.5.1 or above addressing the issue; version 7.6 is unaffected. The public PoC raises the urgency for organizations running affected versions to upgrade, as the exploit does not require authentication.