External risk intelligence

Fortinet FortiSIEM Path Traversal Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-106173

FortiSIEM is a centralized security information and event management platform. These solutions are frequently deployed with network interfaces accessible to multiple segments or exposed as management gateways to ingest data from distributed environments, making them common targets for network-based exposure.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Fortinet's FortiSIEM product, a system used for security information and event management. This flaw could potentially allow unauthorized code execution through specially crafted network packets, posing a significant risk to the integrity and security of the affected systems.

A system flaw allows code execution through crafted packets.
It's critical for managing security events across networks.
Confirm relevance and assess exposure to this critical risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to an exposed FortiSIEM instance. This could allow them to bypass intended security controls and execute arbitrary code or commands on the system.

Network access required.
Specially crafted packets trigger vulnerability.
Potential for unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in Fortinet FortiSIEM could allow an unauthenticated attacker to execute arbitrary commands on the system by sending specially crafted network packets. This could lead to unauthorized code execution and potentially compromise the integrity and availability of the affected system.

System commands and code execution.
Via specially crafted network packets.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability in Fortinet FortiSIEM is likely to fall under the responsibility of the Security Operations or Infrastructure teams, as it affects a critical security management platform. The immediate first step should be to determine the deployment scope and exposure of the affected FortiSIEM instances, identify the designated owner for this technology, and then prioritize remediation actions based on the potential business impact and exploitability.

Security Operations or Infrastructure teams own.
Verify FortiSIEM exposure and reachability.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fortinet FortiSIEM?

FortiSIEM is a centralized security information and event management platform. Organizations use it to aggregate and analyze logs, alerts, and performance data from across their entire IT infrastructure, providing a unified view for threat detection and compliance monitoring.

How does this path traversal vulnerability work?

Classified as CWE-22, path traversal occurs when software fails to properly sanitize user-supplied input used to build file paths. In CVE-2026-106173, this weakness allows an attacker to navigate outside the intended directory structure to access or execute arbitrary system files or commands that should be restricted.

Do I need to be authenticated to trigger CVE-2026-106173?

No, authentication is not required to trigger this vulnerability. It is initiated by sending specifically crafted network packets to the system. Legitimate traffic or standard administrative actions that do not contain these malformed packet sequences will not activate this flaw.

Why is this FortiSIEM flaw a high priority?

According to Halo Surface Signal, FortiSIEM is often deployed with network interfaces that are reachable from multiple segments or act as management gateways. Because it is designed to ingest data from distributed environments, it is frequently placed in positions that make network-based exposure highly likely.

When should I take action for this vulnerability?

You should prioritize this immediately by identifying every instance of FortiSIEM 7.5.0 running in your environment. Determine which systems are reachable over the network and work with your infrastructure teams to assess risk and apply authorized vendor updates as soon as they are available.

References

fortiguard.fortinet.com/psirt/FG-IR-26-180

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.