# CVE-2026-106173: Fortinet FortiSIEM path traversal in grpc phQueryMaster

Source: https://junglewise.ai/threats/cve-2026-106173-a-improper-limitation-of-a-pathname-to-a-restricted-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106173 · Severity: critical · CVSS 9.8 · Published 2026-10-13

Fortinet FortiSIEM is a security information and event management platform used to monitor and analyze security events across enterprise networks. An unauthenticated attacker can exploit a path traversal vulnerability in the grpc phQueryMaster component by sending specially crafted packets to execute arbitrary code or commands, potentially compromising the entire monitoring infrastructure and exposing sensitive security data.

Technologies: [Fortinet Fortisiem](https://junglewise.ai/threats/technologies/fortisiem). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-106173 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106173 being exploited in the wild.

**How severe is CVE-2026-106173?** Critical severity, with a CVSS score of 9.8, published 13 October 2026.

**Which products and versions are affected?** Fortinet Fortisiem 7.5.0.

**Is there a fix for CVE-2026-106173?** Yes: fixed in FortiSIEM 7.5.1 and above. Until then: Restrict access to TCP port 27918 at the network boundary until the system can be upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106173 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-106173?** Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FortiSIEM 7.5.1 and above

Restrict access to TCP port 27918 at the network boundary until the system can be upgraded.

## Technical details

An improper limitation of pathname validation (CWE-22) in FortiSIEM's grpc phQueryMaster component allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted packets. The vulnerability requires network access to TCP port 27918 but no authentication, making it trivially exploitable from the network boundary.

## Affected products

- Fortinet FortiSIEM 7.5.0

## Timeline

- 2026-10-13: disclosed: Initial publication by Fortinet PSIRT

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-180](https://fortiguard.fortinet.com/psirt/FG-IR-26-180)

## Related threats

- [Fortinet FortiSIEM open redirect vulnerability](https://junglewise.ai/threats/cve-2026-84389-fortinet-fortisiem-open-redirect-vulnerability)
- [A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2…](https://junglewise.ai/threats/cve-2026-70467-a-server-side-request-forgery-ssrf-vulnerability-in-fortinet)
- [Fortinet FortiSIEM XSS in Domain parameter](https://junglewise.ai/threats/cve-2026-59838-fortinet-fortisiem-xss-in-domain-parameter)
- [An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.](https://junglewise.ai/threats/cve-2025-58324-an-improper-neutralization-of-input-during-web-page-generation)