Critical FortiSIEM Vulnerability: What IT Administrators Need to Know

CYBER FRIDAYS · SECURITY ADVISORY · OCTOBER 24, 2026

A critical Fortinet FortiSIEM vulnerability has moved from a security advisory to a practical threat: public exploit code is available, and Canada’s Cyber Centre says open-source reporting indicates exploitation in the wild. For administrators running vulnerable deployments, the priority is to identify exposure and patch promptly.

What happened?

On October 13, Fortinet disclosed CVE-2026-106173, a path traversal vulnerability in FortiSIEM’s phQueryMaster gRPC service. On October 20, security researchers at Horizon3.ai published a technical analysis and proof-of-concept exploit. The Canadian Centre for Cyber Security updated its advisory on October 23 to highlight reporting of exploitation in the wild.

A public proof of concept demonstrates that a flaw can be exploited; it does not, by itself, establish how many organizations have been compromised. Administrators should treat the government’s updated warning seriously without assuming every vulnerable system has been breached.

What is FortiSIEM?

FortiSIEM is a security information and event management (SIEM) platform. Security teams use SIEM systems to bring together logs and events from servers, network equipment and security products, helping analysts investigate unusual activity and respond to incidents.

That makes the issue especially concerning: a system intended to monitor threats can itself become an attack target.

How does the vulnerability work?

According to Horizon3.ai’s research, the affected gRPC service processes client-supplied metadata without adequately restricting file paths. An unauthenticated party able to reach the service on TCP port 27918 may be able to cause files to be written outside the intended directory. Researchers demonstrated how that file-write capability could lead to remote command execution.

In simple terms, the software can be tricked into writing a file where it should not. When that file is subsequently used by the system, the consequences may extend beyond an ordinary file-management error.

Who is affected?

Fortinet’s published remediation identifies FortiSIEM 7.5.0 as affected and recommends upgrading to 7.5.1 or later. Reporting on the advisory states that the 7.6 branch and FortiSIEM Cloud are not affected by this specific flaw. Organizations running older branches should check Fortinet’s advisory and their supported upgrade path rather than assume they are safe.

What should IT and security teams do?

1. Inventory deployments. Identify all FortiSIEM instances and record their exact versions.
2. Patch promptly. Upgrade affected FortiSIEM 7.5.0 systems to version 7.5.1 or a supported later fixed release, following Fortinet’s upgrade guidance.
3. Limit network exposure. Restrict access to TCP port 27918 to trusted systems that genuinely need it. Do not expose administrative or inter-node services to untrusted networks.
4. Review for suspicious changes. Horizon3.ai notes that ordinary application logs may not clearly identify exploitation. Investigate unexpected file modifications and follow the researcher’s defensive indicators alongside your incident-response procedures.
5. Validate after remediation. Confirm the installed version, network access controls and monitoring coverage, and document the change.

Sources and further reading

• Fortinet PSIRT — FG-IR-26-180
• Canadian Centre for Cyber Security — AV26-1037, updated October 23
• Horizon3.ai — technical deep dive
• The Hacker News — coverage of the public exploit

Cyber Fridays is an educational security commentary series by John Brown. Always consult the vendor’s current advisory before making production changes.