FortiSIEM RCE Needs No Login: Why Your Monitor Is the Target

The watcher is the prize

A SIEM is a security information and event management system. It collects logs from firewalls, servers, and cloud workloads. It is the nervous system of a security team.

Attackers know this. On October 20, 2026, researchers at Horizon3.ai published a working exploit for a flaw that hits the watcher itself. No login required.

What the flaw does

CVE-2026-106173 is a path traversal flaw in FortiSIEM's phQueryMaster service. The service uses gRPC, a way for programs to call each other over a network. It listens on TCP port 27918.

The service skips client certificates. Any remote client can connect. That is the first failure.

The second failure is in the SendQueryResult call. The server builds a file path by pasting an attacker supplied query id into a folder path. It never checks the value. A query id like ../../../../../tmp/x walks the write out of the intended folder.

The server appends its own text to the file name. The exploit defeats that with a null byte. A null byte is a character that marks the end of a string. The operating system cuts the name there and drops the server's ending. The attacker picks the exact file.

Fortinet rates the flaw 9.4. Several vulnerability databases list 9.8. Both scores are critical. Fortinet's own advisory is FG-IR-26-180, first published October 13, 2026.

Why a SIEM flaw is worse than a normal flaw

A compromised server lets an attacker steal data. A compromised SIEM lets an attacker steal data and erase the record of it.

From FortiSIEM, an attacker can disable detection rules. They can alter stored logs. They can read the credentials the SIEM holds for its monitored systems. Those credentials reach back into every corner of the network.

Horizon3.ai found no clear log line that shows the attack. The service writes files without leaving an obvious trail. Defenders must check file timestamps and scheduled scripts by hand.

What to do now

Confirm your version. FortiSIEM 7.5.0 needs the fix. Upgrade to 7.5.1 or later. Version 7.6 and FortiSIEM Cloud are not affected.

If you cannot upgrade today, restrict access to TCP port 27918. Fortinet says that stops the attack. Do not leave the service reachable from the internet.

Then check for prior compromise. Look at file timestamps under the FortiSIEM install. Look for unexpected changes in scheduled scripts. Horizon3.ai names two high risk files, /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool.

The governance lesson

Governance says prove the state of your controls, not just their existence. Your SIEM is a control. Its patch state is evidence.

Three records close this one. First, the version record that shows your FortiSIEM build before and after the fix. Second, the network rule that limited port 27918, with its date. Third, the compromise check, dated and signed.

Keep those three. An assessor will ask whether the tool that collects your evidence can itself be trusted. This month is the reason why.

Sources

• FG-IR-26-180: FortiSIEM path traversal vulnerability, Fortinet Product Security, October 13, 2026. https://www.fortiguard.com/psirt/FG-IR-26-180
• CVE-2026-106173 record, CVE Program. https://www.cve.org/CVERecord?id=CVE-2026-106173
• FortiSIEM CVE-2026-106173 technical analysis and proof of concept, Horizon3.ai, October 20, 2026.

Next step

Want control evidence that pulls itself from your live systems? See how PolicyCortex collects it on Azure.