Exploiting Fortinet FortiSIEM: CVE-2026-106173 Path Traversal to RCE

The Fortinet FortiSIEM’s new vulnerability, CVE-2026-106173, surfaced recently, exposing significant risks due to its path traversal exploit that leads to remote code execution (RCE). This vulnerability exclusively targets the FortiSIEM component, specifically exploiting its gRPC service. The exploit was identified in early 2026, showcasing a highly sophisticated attack vector refocusing on critical infrastructure components. As of now, no direct attributions to specific threat actors have been established, but the implications suggest potential interest from state-sponsored groups due to the high-impact nature of this vulnerability.

Organizations leveraging FortiSIEM are now critically exposed if they haven’t patched against this vulnerability. The mechanism utilizes a gRPC-based path traversal method, effectively allowing attackers to write arbitrary files to crucial system directories that subsequently lead to RCE. The depth of access provided through such an exploit poses a significant risk across industries reliant on FortiSIEM for security, monitoring, and compliance functions.

How It Was Built

The attack infrastructure for this exploit is fascinatingly straightforward yet devastatingly effective. In essence, attackers construct a gRPC payload that abuses FortiSIEM’s path handling, crafting requests that manipulate the file paths used within the system. This misleads FortiSIEM into overwriting or injecting files into sensitive directories.


// Example gRPC request format leading to path traversal

{

  "request": {

    "filePath": "../../../../bin/payload.sh",

    "fileContent": "echo malicious_code_execution",

    "action": "writeFile"

  }

}

The above payload particularly demonstrates how attackers can insert an executable script into the system. Attackers often disguise these scripts as legitimate system or application files. Delivery of this payload is typically over network vectors where gRPC communications are expected, circumventing many traditional security tools focusing on HTTP/HTTPS traffic analysis.

Why It Worked

The success of this exploit hinges on several notable factors:

Use of gRPC: Utilizing gRPC circumvents traditional HTTP-focused security layers, exploiting architectures not historically scrutinized for such vulnerabilities.
Lack of Path Sanitization: The vulnerability capitalizes on insufficient path validation, which did not sanitise directory traversal characters.
Targeting Critical Infrastructure: By focusing on SIEM systems, attackers aim to disable or manipulate the very systems organizations rely on for intrusion detection.

Operator Takeaways

Red teamers and penetration testers can replicate several aspects of this attack vector:

Emulate the Environment: Set up simulations that leverage gRPC protocols to understand potential blind spots.
Validate Path Handling: Investigate path traversal across other applications with potentially similar constructs in their protocol layers.
Develop Comprehensive Payloads: Build payloads aiming at critical system files, not just user data, to test systemic responses.

Good / Better / Best

Good: Test basic gRPC-request patterns against known vulnerabilities.
Better: Craft complex payloads mimicking legitimate applications.
Best: Deploy multi-tiered attacks targeting the integration points of SIEM systems to test real-world detection and response capabilities.

References

For a detailed breakdown of this vulnerability, refer to Horizon3’s comprehensive analysis on their website.