Fortinet FortiSIEM 7.5.0 CVE-2026-106173 (CVSS 9.4): unauthenticated path traversal and arbitrary file write in the phQueryMaster gRPC service lets attackers run code; upgrade to 7.5.1 or block TCP 27918

Fortinet's FG-IR-26-180, published on 13 October 2026, fixes CVE-2026-106173 in FortiSIEM. Fortinet titles it an arbitrary file write in the gRPC phQueryMaster service and describes a path traversal (CWE-22) that may let an unauthenticated attacker execute unauthorised code or commands with specially crafted packets. It rates the flaw Critical, 9.4 (CVSS 3.1). Only FortiSIEM 7.5.0 is listed as affected; 7.6 is not affected and FortiSIEM Cloud is not affected. The fix is 7.5.1. Fortinet gives a workaround: restricting access to TCP port 27918 prevents the issue. The flaw was found internally by Fortinet's product security team, and the advisory marks it as not known to be exploited. FortiSIEM collects logs and credentials for the systems it monitors and is widely run by managed security providers, and older FortiSIEM bugs have been exploited soon after disclosure, so a SIEM that accepts traffic from untrusted networks is worth treating as urgent. Released in the same Fortinet monthly batch as the critical FortiSandbox flaw CVE-2026-107656 (its own card).

Product

Fortinet FortiSIEM (phQueryMaster gRPC service)

Versions

Affected: FortiSIEM 7.5.0. Not affected: FortiSIEM 7.6 and FortiSIEM Cloud. Fixed: 7.5.1 or later.

CVSS

9.4 (Fortinet, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Upgrade FortiSIEM 7.5.0 to 7.5.1 or later (or to 7.6). If you cannot upgrade straight away, use Fortinet's workaround: restrict TCP port 27918 so only trusted FortiSIEM nodes can reach it. Check that no FortiSIEM supervisor, worker or collector service is reachable from the internet, and review the appliance for unexpected files or processes.

Primary: Fortinet PSIRT FG-IR-26-180 — FortiSIEM arbitrary file write in gRPC phQueryMaster (13 Oct 2026) · Vendor: FortiGuard — CVE-2026-106173 FortiSIEM path traversal · CVE: CVE-2026-106173, CVE-2026-107656

vulnerabilities network