FortiSIEM path traversal flaw allows unauthenticated code execution

FortiGuard PSIRT issued an advisory on October 13, 2026, detailing a security flaw in FortiSIEM. The vulnerability enables an unauthenticated attacker to execute unauthorized code or commands by sending specially crafted packets to the system.

The issue stems from improper limitation of a pathname to a restricted directory, known as path traversal. According to the Fortinet advisory, this weakness is classified under CWE-22 and carries a CVSSv3 score of 9.4. The advisory lists this score without assigning a specific severity label such as high or critical.

Technical details of the vulnerability

The advisory identifies the core problem as a failure to properly restrict file paths within the grpc phQueryMaster component of FortiSIEM. Because the application does not adequately limit where files can be written or accessed, an attacker can traverse directory structures. This manipulation allows the remote actor to write arbitrary files or execute commands on the host machine without needing valid credentials.

FortiGuard PSIRT revised the advisory on October 13, 2026. The update ensures that security professionals have the latest information regarding the attack vector and its potential impact. The advisory specifically notes that the exploit requires no prior authentication, making any exposed instance vulnerable to remote exploitation.

Affected systems and scope

The vulnerability affects FortiSIEM, a security information and event management platform developed by Fortinet. The flaw exists within the grpc phQueryMaster service, which is integral to the application's data handling processes. Any deployment of FortiSIEM that includes this vulnerable component is at risk of unauthorized command execution if the service is accessible to untrusted networks.

Organizations using FortiSIEM for log management and security monitoring should treat this finding with urgency. The lack of an authentication requirement lowers the barrier for attackers, potentially allowing automated scanning tools to identify and exploit the flaw. The CVSS score of 9.4 reflects the metrics calculated by the vendor.

What should you do?

Security teams should immediately verify if their FortiSIEM instances are accessible from untrusted networks. Restricting network access to the grpc phQueryMaster service can reduce the attack surface while a permanent solution is sought. Administrators should monitor logs for unusual file write activities or unexpected command executions that may indicate an active exploitation attempt.