Quick answers
- Is CVE-2026-106173 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106173 being exploited in the wild.
- How severe is CVE-2026-106173?
- Critical severity, with a CVSS score of 9.8, published 13 October 2026.
- Which products and versions are affected?
- Fortinet Fortisiem 7.5.0.
- Is there a fix for CVE-2026-106173?
- Yes: fixed in FortiSIEM 7.5.1 and above. Until then: Restrict access to TCP port 27918 at the network boundary until the system can be upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106173 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-106173?
- Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: FortiSIEM 7.5.1 and above
Restrict access to TCP port 27918 at the network boundary until the system can be upgraded.
Technical details
An improper limitation of pathname validation (CWE-22) in FortiSIEM's grpc phQueryMaster component allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted packets. The vulnerability requires network access to TCP port 27918 but no authentication, making it trivially exploitable from the network boundary.
Affected products
- Fortinet FortiSIEM 7.5.0
Timeline
- 2026-10-13: disclosed: Initial publication by Fortinet PSIRT