Fortinet published a critical flaw in one FortiSIEM release that needs no login. A crafted packet against the log collector can run commands on the box that is supposed to watch the rest of the network. Fortinet says it is not being exploited.

What happened

On 13 October 2026 Fortinet published FG-IR-26-180, an improper limitation of a pathname to a restricted directory in the grpc phQueryMaster component. The assigned id is CVE-2026-106173. Fortinet scores it 9.4 and says an unauthenticated attacker may execute unauthorized code or commands via specially crafted packets. The vendor lists known exploitation as no. Fortinet found it internally. There is no virtual patch.

The same October batch includes other Fortinet issues, including a separate FortiSandbox GUI authentication bypass. Those are different products and different flaws. This post covers only the FortiSIEM path traversal.

Who is affected

The vendor table is narrow. Do not apply this advisory to every FortiSIEM version.

• Affected: FortiSIEM 7.5.0 only. Upgrade to 7.5.1 or above.
• Not affected: FortiSIEM 7.6, and FortiSIEM Cloud.
• Workaround until the upgrade: restrict access on TCP port 27918. Fortinet says that prevents the issue.

What to do now

If the collector is on 7.5.0, upgrade it to 7.5.1 or later, and close TCP 27918 from untrusted networks until that upgrade is done.

• Confirm the installed FortiSIEM version. Only 7.5.0 is in scope for this advisory. 7.6 and FortiSIEM Cloud are not.
• Upgrade 7.5.0 to 7.5.1 or above. There is no virtual patch.
• Until the upgrade lands, restrict TCP port 27918 so only management hosts that must reach phQueryMaster can do so.
• After the change, review collector logs for unexpected connections to that port since 13 October. Absence of a KEV listing is not a reason to leave 7.5.0 internet-reachable.

What this means for South African businesses

Most local SMEs do not run FortiSIEM. The ones that do, and the MSPs that host a collector for several clients, have a single box that already holds logs, credentials context, and a map of the network. An unauthenticated command path on that box is worse than the same bug on a workstation, because the attacker lands inside the system used to notice them. Treat any 7.5.0 collector that can be reached off the management LAN as exposed until 7.5.1 is on it, even though Fortinet has not reported attacks.

Source: Fortinet FG-IR-26-180.