Horizon3 Details Unauthenticated RCE in Fortinet FortiSIEM via gRPC Path Traversal

Horizon3.ai researchers published a detailed analysis of CVE-2026-106173 on October 13, 2026, describing a critical vulnerability in Fortinet FortiSIEM. The flaw exists in an unauthenticated gRPC service, allowing attackers to write arbitrary files and execute remote code on affected systems.

The vulnerability impacts the phQueryMaster service, which listens on port tcp/27918. According to the Horizon3.ai report, this service does not require client certificates for authentication. This configuration allows any remote client to connect directly to the vulnerable gRPC endpoint without presenting credentials, exposing the system to unauthenticated exploitation attempts.

Technical Analysis of the Exploit

Horizon3.ai identified that the SendQueryResult RPC method within the service fails to validate input properly. The handler constructs a file path using attacker-controlled values, specifically the query-id and src-ip fields. By manipulating the query-id, an attacker can perform path traversal to write files outside the intended query directory.

The service appends a fixed suffix to the filename, limiting the attacker's control over the exact name. However, researchers discovered that the server copies header values using the exact length declared by the client. This behavior allows an attacker to embed a null byte in the middle of the query-id string.

When the operating system processes the path, it treats the null byte as the end of the string. This effectively discards the server's appended suffix, allowing the attacker to overwrite existing files or create new ones with precise names. Horizon3.ai noted that standard tools like curl cannot inject these null bytes, requiring manually assembled gRPC messages for exploitation.

Scope and Historical Context

This vulnerability affects the FortiSIEM product line from Fortinet. Horizon3.ai stated that this is the first time they have targeted the gRPC service on port tcp/27918. Previous disclosures from the same research team focused on the phMonitor service listening on port tcp/7900, including CVE-2023-34992, CVE-2024-23108, and CVE-2025-64155.

The October 13, 2026 advisory from Fortinet classifies the issue as critical. The researchers emphasized that the combination of unauthenticated access and arbitrary file write capabilities makes the flaw particularly dangerous. No fix has been confirmed in the provided source material, though Fortinet published the advisory on that date.

What should you do?

Security teams should verify if their FortiSIEM instances are running vulnerable versions. Administrators should monitor network traffic for unusual connections to port tcp/27918. Organizations should restrict external access to this port using firewalls until a patch is available.

What to do and how to stay safe: Fortinet

• Check if your FortiSIEM systems are exposed to the internet on port tcp/27918 and block external access immediately.
• Monitor logs for unauthorized gRPC connections or unusual file creation events in temporary directories.
• Review firewall rules to ensure that only trusted internal networks can reach the phQueryMaster service.
• Await official vendor guidance and apply updates once Fortinet releases a confirmed patch for CVE-2026-106173.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-106173?

It is a critical vulnerability in Fortinet FortiSIEM that allows unauthenticated remote code execution via a gRPC path traversal flaw.

Which service is affected?

The phQueryMaster service, which listens on port tcp/27918, is affected by this vulnerability.

How do attackers exploit this flaw?

Attackers use path traversal and null-byte injection in gRPC headers to write arbitrary files and execute code without authentication.