FortiSIEM 7.5.0 has a critical unauthenticated file-write flaw

FortiSIEM 7.5.0 has a critical unauthenticated file-write flaw

13 October 2026: Fortinet has fixed CVE-2026-106173, a critical path traversal flaw in FortiSIEM 7.5.0 that lets an unauthenticated attacker write arbitrary files through the phQueryMaster daemon's gRPC interface and run unauthorised code or commands. It is rated 9.4 and fixed in FortiSIEM 7.5.1.

Not yet independently verified. Fortinet does not report exploitation, but its CVSS vector rates exploit code maturity as high, and a technical write-up by Horizon3 appeared on 20 October; we have not read that write-up. We will update this when it can be confirmed, and remove this note.

Affected and fixed versions

Product	Status
FortiSIEM 7.5.0	affected: upgrade to 7.5.1 or above
FortiSIEM 7.6, all versions	not affected
FortiSIEM Cloud	not affected

The advisory, FG-IR-26-180, was published on 13 October. It classes the bug as CWE-22, improper limitation of a pathname to a restricted directory, reachable over the network with no privileges and no user interaction. Fortinet says the flaw was found internally, by its own product security team.

How serious it is

A SIEM is a high-value target because it receives logs and often credentials from across a network, and a compromised collector or supervisor can be used to hide an intrusion. Fortinet's advisory does not report exploitation in the wild, but the CVSS vector it publishes rates exploit code maturity as high, and the security firm Horizon3 published a technical write-up on the flaw on 20 October. Once the mechanics of a flaw like this are public, scanning for exposed instances usually follows quickly.

Fortinet published several lower-rated FortiSIEM, FortiOS, FortiProxy, FortiSwitch and FortiSandbox advisories on the same day, including FG-IR-26-183, a missing-authorisation flaw in the FortiSIEM interface. Our earlier October Fortinet item covers the FortiAnalyzer, FortiManager and FortiMail fixes.

If you cannot upgrade straight away

Fortinet's workaround is to restrict access to TCP port 27918, which the phQueryMaster service listens on. In practice that means making sure the port is reachable only from the FortiSIEM nodes and collectors that need it, never from the internet or from general user networks, and checking firewall logs for unexpected connections to it since 13 October. Teams on 7.5.0 should treat the upgrade to 7.5.1, or a move to 7.6, as urgent, and review the supervisor and worker nodes for unexpected files after patching.

Sources

• Fortinet PSIRT: FG-IR-26-180, arbitrary file write in gRPC phQueryMaster, 13 October 2026
• Fortinet PSIRT: FG-IR-26-180 CSAF record, 13 October 2026