{"id":3629,"date":"2026-10-20T16:12:54","date_gmt":"2026-10-20T16:12:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3629"},"modified":"2026-10-20T16:12:54","modified_gmt":"2026-10-20T16:12:54","slug":"critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-execution","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3629","title":{"rendered":"Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 20, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg3BuJLxcpzxzxwpUcwsPb7L-gNCeXeyuPtNysOMHtf06VmANCx2DR3O52Puw9AQwUu0C8ccQ77MF_l0bAf4zL-hrvYO8jSHs6Km0Xz6-Q4yYm1thRvJ-y59qLRX9Qni0zD161qJ53oCgzEIo3NjOLKtgOrIAbOMsAhITOhL9qoy2v9D6tRU26m0fBoMDhJ\/s1700-nu-rw-lo-l85-e365\/fort-poc.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have <a href=\"https:\/\/horizon3.ai\/attack-research\/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce\/\" target=\"_blank\">released<\/a> a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.<\/p>\n<p>The vulnerability, tracked as <strong><a href=\"https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-26-180\" target=\"_blank\">CVE-2026-106173<\/a><\/strong> (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.<\/p>\n<p>Patches for the flaw were released last week by Fortinet in the following versions &#8211;<\/p>\n<ul>\n<li>FortiSIEM 7.5.0 (Upgrade to 7.5.1 or above)<\/li>\n<li>FortiSIEM 7.6 (Not affected)<\/li>\n<\/ul>\n<p>According to Horizon3.ai, the issue involves an unauthenticated attacker connecting to the gRPC service listening on TCP port 27918 and exploiting the flaw to overwrite an existing file outside of the intended directory and turn the arbitrary-file-write primitive into remote code execution.<\/p>\n<p>\u00abThe FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation,\u00bb Horizon3.ai <a href=\"https:\/\/github.com\/horizon3ai\/CVE-2026-106173\" target=\"_blank\">said<\/a>. \u00abBy crafting metadata containing both path traversal sequences (..\/) and NUL-byte injection within gRPC&#8217;s HTTP\/2 and HPACK encoding layers, an attacker can write arbitrary files to the file system.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The problem stems from a case of unsafe path construction within a function named SendQueryResult(), which passes a user-supplied \u00abquery-id\u00bb parameter directly without sufficient validation.<\/p>\n<p>In other words, an attacker can leverage this flaw to include directory traversal sequences such as \u00ab..\/\u00bb and escape that directory. However, this only allows an attacker to navigate to a directory of their choice and write to it, but not to opt for a file name because the program automatically adds its own file name \u00abresult-<source ip=\"\" address=\"\">-0-0-<id>.dat,\u00bb where <id> is a counter value controlled by the server.<\/id><\/id><\/source><\/p>\n<p>That&#8217;s where a second weakness enters the picture: a null byte (\u00ab\\0\u00bb) can be embedded in the \u00abquery-id\u00bb parameter, causing the operating system to interpret it as a string terminator and discard everything that comes after it. This, in turn, results in the appended file name suffix being ignored when the path is passed to the file-opening function.<\/p>\n<p>An attacker could exploit this behavior to craft a \u00abquery-id\u00bb value with \u00ab\\0\u00bb placed such that it&#8217;s preceded by the actual file name to be overwritten \u2013 i.e., \u00ab..\/..\/..\/..\/..\/opt\/charting\/redishb.sh\\0&#8230;\u00bb The file in question is a shell script that performs health checks on the Redis service and is run every 60 seconds by a cron job.<\/p>\n<p>\u00abThe write lands on the exact path that preceded the null byte,\u00bb Zach Hanley, Chief Attack Engineer at Horizon3.ai, said. \u00abPointed at an existing file, this overwrites it in place, keeping the original owner and permissions; a second variant uses two requests to create a brand-new file with an exact name.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 20, 2026Vulnerability \/ Enterprise Security Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3630,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[10,58,13,120,70,3861,1730,328,12,725],"class_list":["post-3629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-code","tag-critical","tag-execution","tag-exploit","tag-flaw","tag-fortisiem","tag-poc","tag-public","tag-remote","tag-unauthenticated"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3629"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3629\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3630"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}