FortiSIEM Vulnerable to Arbitrary File Write via gRPC Path Traversal
Fortinet has disclosed a critical path traversal vulnerability in FortiSIEM, enabling unauthenticated attackers to write arbitrary files and potentially execute code.
Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing a critical vulnerability within its FortiSIEM product. Identified as FG-IR-26-180, the flaw is a path traversal vulnerability (CWE-22) that affects specific versions of FortiSIEM.
The vulnerability resides in the gRPC interface, specifically within the phQueryMaster component. Attackers can exploit this by sending specially crafted packets to the affected system. The nature of the flaw allows for arbitrary file writes, meaning an attacker can choose where and what file to write on the target system. This capability is particularly dangerous as it can be leveraged to overwrite critical system files or inject malicious code.
With a CVSSv3 score of 9.4, this vulnerability is rated critical. The high score is attributed to its network accessibility (AV:N), low complexity (AC:L), lack of authentication requirements (PR:N), and the potential for high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The advisory notes that successful exploitation could lead to unauthorized code or command execution on the compromised FortiSIEM instance.
Fortinet has assigned the Common Vulnerabilities and Exposures identifier CVE-2026-106173 to this flaw. The vulnerability impacts FortiSIEM versions 7.6 and 7.5. The advisory indicates that the vulnerability was discovered and reported internally by a member of the Fortinet Product Security team, Gwendal Guégniaud.
While the advisory does not explicitly detail active exploitation in the wild, the critical nature and high CVSS score suggest a significant risk to organizations using the affected versions of FortiSIEM. The ability to write arbitrary files can pave the way for complete system compromise, including the deployment of ransomware, persistent backdoors, or data exfiltration tools.
Fortinet has provided specific versions that are affected, and users are strongly advised to consult the official advisory for remediation steps. While the advisory itself does not list specific patches, it typically implies that updates will be made available or that users should upgrade to the latest secure versions. The CVSS vector also includes exploitability metrics (E:H/RL:O/RC:C), suggesting a high potential for exploitation and a need for prompt action.
This vulnerability underscores the ongoing risks associated with complex network management and security information and event management (SIEM) solutions. Such systems often have broad network access and contain sensitive security data, making them prime targets for attackers. The use of gRPC, a high-performance, open-source framework for remote procedure calls, also highlights the need for security scrutiny in modern communication protocols.
Organizations utilizing FortiSIEM should prioritize assessing their exposure to CVE-2026-106173 and apply any available security updates or mitigations recommended by Fortinet to prevent potential compromise. The potential for code execution makes this a high-priority issue for security teams.