"The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation," Horizon3.ai said.
How the flaw works: path traversal plus NUL-byte injection
The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw in Fortinet FortiSIEM that can be triggered by an unauthenticated attacker. According to Horizon3.ai, the defect arises because a function named SendQueryResult() uses a user-supplied "query-id" parameter directly without sufficient validation. That unsafe path construction allows an attacker to include directory traversal sequences such as "../" to escape the intended directory and navigate to arbitrary folders on the file system.
Alone, the traversal only lets an attacker target a directory; the FortiSIEM program appends its own filename in the pattern "result-<source IP address>-0-0-<id>.dat", where <id> is a server-controlled counter. Horizon3.ai described a second weakness that turns the traversal into a file-overwrite primitive: a null byte ("\0") can be embedded in the "query-id" parameter. The operating system treats the null byte as a string terminator and discards anything that follows, causing the appended filename suffix to be ignored when the path is passed to the file-opening function.
Proof-of-concept exploit and demonstrated impact
Cybersecurity researchers have released a proof-of-concept (PoC) exploit that chains these two weaknesses. The PoC connects to the FortiSIEM gRPC service listening on TCP port 27918, crafts metadata containing both path traversal sequences ("../") and NUL-byte injection within gRPC's HTTP/2 and HPACK encoding layers, and writes arbitrary files to the file system.
Horizon3.ai gave a concrete example of the technique: a "query-id" value crafted as "../../../../../opt/charting/redishb.sh\0..." targets an existing file named /opt/charting/redishb.sh. That specific file is a shell script that performs health checks on the Redis service and, according to the report, is run every 60 seconds by a cron job. Zach Hanley, Chief Attack Engineer at Horizon3.ai, said, "The write lands on the exact path that preceded the null byte. Pointed at an existing file, this overwrites it in place, keeping the original owner and permissions; a second variant uses two requests to create a brand-new file with an exact name."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFortinet's patches and version guidance
Fortinet released patches last week for affected FortiSIEM builds. The vendor's guidance states that FortiSIEM 7.5.0 should be upgraded to 7.5.1 or above; FortiSIEM 7.6 is listed as not affected. The PoC and public descriptions followed those patch releases.
What this means for FortiSIEM administrators, security operations teams, and potential attackers
- FortiSIEM administrators: Systems running FortiSIEM 7.5.0 are identified in the advisory as requiring an upgrade to 7.5.1 or later; FortiSIEM 7.6 is stated as not affected. The vulnerability is exploitable without authentication over the gRPC service on TCP port 27918, per Horizon3.ai.
- Security operations and incident response teams: The PoC demonstrates arbitrary file writes and in-place overwrites that preserve file owner and permissions. Horizon3.ai also described a two-request variant that can create a new file with an exact name, expanding the range of possible impacts on monitored hosts.
- Adversaries and remote attackers: The exploit requires connecting to the FortiSIEM gRPC endpoint and crafting metadata that combines path traversal sequences and NUL-byte injection within HTTP/2 and HPACK encoding layers, turning an unauthenticated vector into remote code execution against targeted files.
Conclusion
CVE-2026-106173 is a high-severity, unauthenticated remote code execution risk that leverages unsafe path handling in SendQueryResult() and a null-byte termination behavior to bypass the product's filename suffix. Fortinet issued patches last week and marked FortiSIEM 7.6 as not affected; FortiSIEM 7.5.0 should be upgraded to 7.5.1 or later, per the vendor's guidance. Horizon3.ai's PoC shows the technique can overwrite existing files—preserving owners and permissions—or create new files with exact names, and includes a concrete example targeting a cron-run Redis health-check script.
Original report: https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
