Security firm Horizon3.ai has published a proof-of-concept exploit for CVE-2026-106173, a critical unauthenticated path traversal vulnerability in Fortinet FortiSIEM that leads to remote code execution. The flaw carries a CVSS score of 9.4, and Fortinet shipped fixed versions the week before the exploit appeared.
CVE-2026-106173: Unauthenticated Path Traversal in the FortiSIEM gRPC Service
The vulnerability affects the gRPC service in Fortinet FortiSIEM, which listens on TCP port 27918. Horizon3.ai released its proof-of-concept on Tuesday. The release is a new development in the FortiSIEM issue and is separate from the earlier FortiSIEM patch batch.
Because the flaw is unauthenticated, an attacker needs only network access to the exposed service. With working exploit code now public, unpatched FortiSIEM deployments are exposed to remote code execution without any credentials.
How the QueryResultReq Handler Turns a File Write Into Code Execution
Horizon3.ai’s analysis traces the exploit to a single gRPC handler, where an input validation gap becomes an arbitrary file write and then code execution in two steps.
The Unvalidated query-id Parameter
The root cause sits in the gRPC QueryResultReq handler, specifically the function SendQueryResult(). The handler takes a user-supplied “query-id” value and passes it into a file path without validating it. Path traversal sequences in that value let an attacker choose where on the system the file is written, giving an arbitrary file write location.
Null Byte Truncation of the Fixed Filename Suffix
On its own, the write has a limit: the filename is fixed in the form “result–0-0-.dat,” so an attacker cannot freely pick the file name or extension. Horizon3.ai’s analysis shows that injecting a null byte into the parameter truncates the suffix. That gives the attacker control over the file name and turns the arbitrary write into code execution.
The disclosure sequence for CVE-2026-106173 shows how the technical details fit together. The path traversal alone gives an attacker the ability to write a file to a location of their choosing. Because the handler fixes the file name as “result–0-0-.dat,” the write on its own does not obviously yield code execution. The null byte is what changes that, since it cuts off the fixed suffix and lets the attacker choose the name and type of the file that lands on disk.
The vulnerability sits in a gRPC service rather than in a web interface, and it requires no authentication, so the exposure depends on whether TCP port 27918 can be reached. Fortinet’s advisory lists the fixed FortiSIEM versions, and Horizon3.ai’s proof-of-concept now gives anyone the means to test a reachable system.
Fortinet’s Fixed Versions and Network Exposure
Fortinet released fixed FortiSIEM versions the week before the exploit became public, with the affected and fixed version numbers listed in the company’s advisory. Administrators should apply the fixed releases listed there. Restricting access to port 27918 limits exposure in the interim for systems that cannot be updated immediately.
Timeline of the FortiSIEM Disclosure
Fortinet issued its patches during the week of October 12. Horizon3.ai followed with the public proof-of-concept on October 20, roughly a week later. That gap is typical of how defenders and attackers now race on high-severity bugs: a vendor patch gives researchers a reference point for reverse engineering the fix, and a public exploit follows.
The reporting on the disclosure is thin on one point: it does not say whether attackers have used the flaw in the wild. It states that Fortinet shipped fixed versions last week and that Horizon3.ai published the proof-of-concept on Tuesday, and it frames the exposure as that of unpatched FortiSIEM deployments now that exploit code is public. Fortinet’s guidance is to move to the fixed versions listed in its advisory and to restrict access to port 27918 in the meantime.
FortiSIEM collects and correlates logs from across an organization’s network, which makes the appliance a high-value target. A compromised security information and event management system could expose the logs and credentials it stores, though the available reporting does not describe any attacks against FortiSIEM using the new exploit. The immediate task for operators is confirming their FortiSIEM version against Fortinet’s advisory and verifying that port 27918 is not reachable from untrusted networks.
