Fortinet FortiSIEM gRPC Path Traversal RCE

A critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-106173, has been discovered in Fortinet FortiSIEM. The vulnerability resides in the gRPC `QueryResultReq` handler, which fails to properly validate path metadata. A proof-of-concept (PoC) exploit has been released publicly by Horizon3.ai, significantly increasing the risk of active exploitation.

Technically, the flaw allows an attacker to use path traversal sequences and NUL-byte injection within gRPC's HTTP/2 and HPACK encoding layers to perform an arbitrary file write. By overwriting scripts triggered by system cron jobs, attackers can achieve code execution within approximately 60 seconds of the initial request.

This vulnerability is highly critical for organizations using FortiSIEM, as it requires no authentication and provides a direct path to full system compromise. Immediate patching or network-level restrictions on the gRPC port are strongly recommended.