FortiSIEM CVE-2026-106173: root with no login

CVE-2026-106173, a path traversal in phQueryMaster, a FortiSIEM gRPC service listening on TCP port 27918. Fortinet scores it 9.4; the NVD record gives 9.8.

The advisory lists FortiSIEM 7.5.0 as affected, fixed in 7.5.1. The CVE record also lists 7.0.0 to 7.4.2 and points to 7.6.0. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Check the advisory for your exact release.

The attacker needs network access to TCP port 27918, and nothing more: no account, and the service did not ask for a client certificate.

Horizon3.ai, who found the flaw, released a public proof of concept.

A request to the service names a file to write. The service does not stop that name from leaving its own directory, so the attacker can write where the appliance's scheduled tasks look.

When the task runs, the attacker's command runs with it, as root.

Root on the SIEM. The logs that should reveal the intrusion can be changed, detection rules switched off, and the credentials it keeps for monitored devices read.

And the SIEM reaches every subnet it watches.

Upgrade to FortiSIEM 7.5.1 or later, or to 7.6. Until then, Fortinet says that restricting access to TCP port 27918 prevents the issue: allow only the collectors that need it.

Then check whether anything was already written: review the scripts that root's scheduled tasks run on the appliance, and root's cron history.

Sources: Fortinet PSIRT FG-IR-26-180, CVE-2026-106173 record, NVD, Horizon3.ai.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.