Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Summary: Researchers released a proof-of-concept exploit for CVE-2026-106173, a critical path traversal flaw in Fortinet FortiSIEM with a CVSS score of 9.4 that lets an unauthenticated attacker execute code or commands via crafted packets. Horizon3.ai said the attack connects to the gRPC service on TCP port 27918, uses path traversal sequences and NUL-byte injection in the query-id parameter to overwrite files such as the Redis health-check script run every 60 seconds by cron, and the Canadian Centre for Cyber Security has updated its advisory to say the flaw is exploited in the wild.
What's compelling: The overwrite lands on a shell script that cron runs every 60 seconds, so an unauthenticated attacker who reaches port 27918 can turn a file write into code execution on a schedule - and the Canadian Centre for Cyber Security now cites open-source reporting that this is already happening.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-106173
- Related
- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026