CVE-2026-106173

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 7.0.0 through 7.0.4 FortiSIEM versions 7.1.0 through 7.1.9 FortiSIEM versions 7.2.0 through 7.2.7 FortiSIEM versions 7.3.0 through 7.3.5 FortiSIEM versions 7.4.0 through 7.4.2 FortiSIEM version 7.5.0

Description An unauthenticated remote code execution issue exists in the phQueryMaster gRPC service, which listens on TCP port 27918. The flaw originates from improper validation of user-controlled metadata in the QueryResultReq handler, specifically within the SendQueryResult RPC method. An attacker can exploit a path traversal vulnerability by manipulating the query-id variable to write arbitrary files to the filesystem. This is further enhanced by a null-byte injection in the header, which allows the attacker to bypass server-appended file suffixes and gain full control over the filename. By overwriting critical system files, such as /opt/charting/redishb.sh or /opt/phoenix/bin/phLicenseTool, an attacker can achieve remote code execution when these files are subsequently invoked by system processes like cron jobs. A proof of concept has been released by Horizon3.ai.

Recommendations For FortiSIEM versions 7.0.0 through 7.0.4, 7.1.0 through 7.1.9, 7.2.0 through 7.2.7, 7.3.0 through 7.3.5, 7.4.0 through 7.4.2, and 7.5.0, upgrade to version 7.5.1 or 7.6.0 and later. Restrict network access to TCP port 27918 to trusted management networks to minimize the risk of exploitation.