FortiSIEM RCE Vulnerability Now Has a Public Exploit
A FortiSIEM RCE vulnerability, CVE-2026-106173, now has a public exploit, and as of October 26 the Canadian Cyber Centre says open-source reporting indicates it is being exploited in the wild. FortiSIEM is the system many teams use to spot attacks, so a compromised appliance costs defenders visibility and hands an attacker a foothold next to the logs.
What Happened With the FortiSIEM RCE Vulnerability
Fortinet patched the flaw on October 13 in advisory FG-IR-26-180, titled arbitrary file write in the grpc phQueryMaster service. Fortinet rates it 9.4; other databases, including NVD, score it 9.8. Fortinet’s advisory lists only FortiSIEM 7.5.0 as affected, with 7.5.1 as the fix; FortiSIEM 7.6 and FortiSIEM Cloud are not affected. On October 19 Horizon3.ai published a working proof of concept.
The bug sits in a service that listens on TCP port 27918 and accepts connections without a client certificate. Per Horizon3’s analysis, a request handler builds a file path from an attacker-supplied value without checking it, so an attacker can write a file anywhere on the appliance. Overwriting a health-check script that a scheduled job runs every 60 seconds turns the file write into code execution. Horizon3 found no application logs that record the attack. As of October 26, Fortinet’s advisory (published October 13) does not mention exploitation; the Canadian Cyber Centre added the exploitation statement to its own advisory on October 23 and did not name a source.
Why It Matters
A FortiSIEM RCE vulnerability is worse than most: a SIEM collects logs from firewalls, servers and identity systems and often stores the credentials it needs to reach them. Whoever controls it can read that data and is hard to see, because the tool that would flag the intrusion is the one compromised. We covered a Fortinet zero-day in FortiMail on October 5; again a security product is the entry point.
Assumption: Fortinet is common in DACH mid-sized companies, and managed security providers also run FortiSIEM for their customers. If your SOC is outsourced, ask which version it runs and whether port 27918 is reachable from outside.
What You Should Do Now
- Find every FortiSIEM node (supervisor, workers, collectors) and note the version. Fortinet lists only 7.5.0 as affected; update to 7.5.1 or later.
- Close TCP port 27918. Fortinet’s workaround is to restrict access; the port should never be reachable from the internet and only needs to be open between FortiSIEM nodes.
- Check for compromise. Compare the modification times of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool with the files around them. A file that was changed recently and does not match is an incident.
- If you find one, isolate the node, keep a disk copy, and rotate the credentials the SIEM stores for log sources and integrations. Also check the other products in the same October 13 Fortinet advisory batch: FortiAnalyzer, FortiManager, FortiMail and FortiSandbox.
DIESEC Perspective
Monitoring tools are often treated as trusted infrastructure and left out of patch cycles and network segmentation. Put them in a management network, keep an owner and a patch deadline on them, and check what they can reach.
Not sure whether your FortiSIEM nodes are exposed or already touched? Contact DIESEC for an exposure check and compromise assessment.
Sources: Canadian Cyber Centre AV26-1037 | Cyber Kendra
Published: 2026-10-28 | Category: Vulnerabilities & Patches | ~4 min read
