Fortinet FortiSIEM Faces Critical Unauthenticated RCE via gRPC Flaw

Fortinet FortiSIEM systems are exposed to a critical vulnerability that enables unauthenticated remote code execution. The flaw, identified as CVE-2026-106173, stems from a path traversal issue within a gRPC service. Fortinet issued a security advisory for this problem on 13 October 2026. The vulnerability allows attackers to write arbitrary files to the system, potentially leading to full control.

How it unfolded

• Horizon3 researchers published a deep-dive analysis of CVE-2026-106173, detailing the technical mechanics of the exploit.
• The research identified the phQueryMaster service, which listens on port tcp/27918, as the vulnerable component.
• Fortinet released a security advisory on 13 October 2026, classifying the vulnerability as critical.
• The advisory notes that the flaw allows arbitrary file writes through an unauthenticated gRPC service.

Who is affected

Fortinet FortiSIEM installations are affected by this vulnerability. The issue resides in the phQueryMaster service, which binds to all network interfaces on port tcp/27918. This service does not require client certificates for authentication, allowing any remote client to connect. Attackers can exploit the SendQueryResult RPC method to traverse directories and write files. The lack of input validation on the query-id parameter enables path traversal.

Our take on the response

Fortinet has acknowledged the vulnerability by publishing a security advisory. The advisory classifies the issue as critical, reflecting the severity of unauthenticated remote code execution. Horizon3 researchers provided detailed technical analysis, including indicators of compromise for defenders. No patch or update has been confirmed yet in the available material. Organizations should monitor Fortinet channels for remediation guidance.

Who needs to act first

Managed service providers should prioritize scanning their FortiSIEM deployments for exposure on port tcp/27918. Teams usually begin by identifying systems with internet-facing interfaces, as these present the highest risk. Check whether firewall rules restrict access to this specific port. If access cannot be immediately blocked, isolate affected systems from untrusted networks. Back up configuration files before applying any emergency measures. Monitor logs for unusual file write activity or unexpected process executions. Coordinate with internal security teams to validate the scope of exposure.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: Fortinet

• Verify if port tcp/27918 is accessible from external networks and restrict access using firewall rules.
• Monitor system logs for unauthorized file writes or unexpected process executions on FortiSIEM servers.
• Check for any unusual outbound connections from FortiSIEM instances that may indicate compromise.
• Once the vendor provides an update, test the patch in a isolated environment before widespread deployment.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-106173?

It is a critical vulnerability in Fortinet FortiSIEM that allows unauthenticated remote code execution via a gRPC path traversal flaw.

Which port is affected by this vulnerability?

The phQueryMaster service listens on port tcp/27918 and is vulnerable to unauthenticated access.

Is there a patch available for CVE-2026-106173?

No fix has been confirmed yet; Fortinet has only published a security advisory regarding the issue.