Fortinet patched a 9.4-rated FortiSIEM flaw last week. Horizon3.ai has now published exploit code for it, and the chain is unusually tidy for a critical bug.
The vulnerability is CVE-2026-106173, a path traversal that lets an unauthenticated attacker write files outside the intended directory and convert that into remote code execution. The gRPC service on TCP port 27918 is the entry point. Fixed builds are FortiSIEM 7.5.1 and later; the 7.6 branch is not affected.
Where the path check fails
Horizon3.ai traced the problem to SendQueryResult(), which passes a caller-supplied query-id into a filesystem path without proper validation. Traversal sequences alone would only let an attacker choose a directory, because the program appends its own filename and a server-side counter.
A null byte closes that gap. Embedding a terminator in query-id makes the operating system discard everything after it, so the appended suffix disappears and the write lands on exactly the path that preceded it.
Zach Hanley, Horizon3.ai’s chief attack engineer, said pointing that at an existing file overwrites it in place while keeping the original owner and permissions. A second variant uses two requests to create a brand-new file with an exact name. Public write-ups describe targeting a Redis health-check script that a cron job runs every minute.
Assume anyone can reach it
An unauthenticated write-to-execute path plus published proof of concept is the pattern that usually precedes mass scanning. Exposed management interfaces should not be internet-facing in the first place. Where they are, upgrade now, then hunt for unexpected files landing outside FortiSIEM’s normal directories and for children spawned by that health-check script.
