Threat reportVulnerabilityTL-2026-3976
Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path Traversal Enables Unauthenticated RCE (Public PoC)
Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path (TL-2026-3976), also tracked as FG-IR-26-180, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-10-20. It has no confirmed attribution, affects Fortinet FortiSIEM, references 2 CVEs (CVE-2026-106173, CVE-2025-64155), maps to 5 MITRE ATT&CK techniques (T1053.003, T1059.004, T1190), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3976
- Threat ID
- TL-2026-3976
- Also known as
- FG-IR-26-180
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
Malware and tooling: Horizon3.ai CVE-2026-106173 PoC
How Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path works
A critical path traversal flaw in the FortiSIEM phQueryMaster gRPC service (TCP 27918) lets an unauthenticated remote attacker write arbitrary files and achieve code execution on FortiSIEM 7.5.0. Horizon3.ai published a technical deep-dive and public PoC on 2026-10-20; Fortinet states exploitation in the wild is not known. Fixed in FortiSIEM 7.5.1.
CVE-2026-106173 (Fortinet PSIRT FG-IR-26-180, CWE-22) affects the phQueryMaster gRPC service of FortiSIEM 7.5.0. The service is implemented in libphGrpcServices.so and listens on [::]:27918 (the port is derived from command_port 7918 via phSecureUtils::getGrpcPort()). Horizon3.ai reports that the gRPC server does not request a client certificate (sslOps.client_certificate_request stays 0, GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE), so no authentication is required. Fortinet's Product Security team (credited to Gwendal Guégniaud) found the flaw internally and published the advisory on 2026-10-13.
The vulnerable handler is the SendQueryResult RPC (grpcNotificationService.cpp), a client-streaming call that receives QueryResultReq messages. It trusts request metadata fields query-id, src-ip, period-start and period-end. The server builds the output directory by string concatenation (/query/result/<query-id>) and the filename as result-<src-ip>-<period-start>-<period-end>-<id>.dat, without validating query-id. Two bugs are chained: (1) path traversal, where a query-id such as ../../../../../tmp/x escapes the query directory; and (2) NUL-byte injection, where the server copies values using client-declared lengths so an embedded \0 survives gRPC's HTTP/2 and HPACK encoding. When the path reaches the OS it truncates at the NUL, which discards the server-appended .dat suffix and gives the attacker exact control over the destination filename. Standard gRPC libraries and curl refuse NUL bytes in headers, so exploitation requires manual gRPC message assembly; a two-request variant is needed to create brand-new files with exact names.
Horizon3.ai's weaponization overwrites /opt/charting/redishb.sh, a shell script that performs Redis health checks and is run by cron every 60 seconds. The overwritten file keeps its original owner and permissions, so the payload runs as the cron job owner (the admin user context). Execution is blind with roughly 60 seconds of latency. A secondary candidate target noted is /opt/phoenix/bin/phLicenseTool. The public PoC (github.com/horizon3ai/CVE-2026-106173, CVE-2026-106173.py, 2 commits) supports -t target, -c command, -p port (default 27918), --plaintext (HTTP/2 without TLS) and --dry-run.
Detection is difficult: Horizon3.ai found no application logs that explicitly reveal exploitation. Suggested hunting signals are unexpected modification or timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool that are inconsistent with neighbouring files, and gRPC connections to TCP 27918 from unexpected sources. Because FortiSIEM is a security monitoring platform, a compromise gives an attacker a foothold on the defender's own visibility infrastructure.
Scoring and scope differ between sources. Fortinet rates the issue CVSS 3.1 9.4 (vector includes temporal metrics E:H/RL:O/RC:C), lists only FortiSIEM 7.5.0 as affected with 7.5.1 or above as the fix, and states FortiSIEM 7.6 and FortiSIEM Cloud are not affected; no virtual patch is available. An earlier collection of this record noted an NVD entry with a 9.8 base score and a broader CPE list (7.0.x-7.4.x), which does not match Fortinet's advisory; the NVD page could not be re-fetched in this pass, so the vendor statement is used as authoritative. Fortinet states exploitation is not known. No threat actor, malware, or network IOCs are named in any source.
Context for prioritization: Horizon3.ai has previously published other FortiSIEM research targeting the phMonitor service on tcp/7900 (CVE-2023-34992, CVE-2024-23108, CVE-2025-64155); this is the first public analysis of phQueryMaster. For CVE-2025-64155, a Horizon3.ai PoC released on 2026-01-15 was followed by in-the-wild exploitation attempts reported by Defused on 2026-01-16, and CVE-2025-25256 had practical exploit code spotted in the wild per Fortinet in August 2025. Defenders should treat a public PoC for a FortiSIEM flaw as a short-fuse exploitation precursor, although no such activity is reported for CVE-2026-106173.
MITRE ATT&CK techniques used in TL-2026-3976
Execution
T1053.003 Cron; T1059.004 Unix Shell
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1565.001 Stored Data Manipulation
Reconnaissance
Affected products and versions in Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
- Fortinet — FortiSIEM
Vulnerable versions: 7.5.0
Fixed in: 7.5.1 or above
Remediation for Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
Patches
- Upgrade FortiSIEM 7.5.0 to 7.5.1 or above (Fortinet FG-IR-26-180)
Immediate actions
- Restrict network access to TCP port 27918 on FortiSIEM supervisors/collectors (Fortinet-documented workaround)
- Hunt for modification of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool with timestamps inconsistent with neighbouring files
- Review network logs for connections to TCP 27918 from unexpected sources
- Inspect /query/result/ and /tmp for unexpected files written outside the normal result-*.dat naming pattern
Workarounds
- Restricting access to tcp port 27918 prevents the issue
Longer-term hardening
- Keep SIEM management and gRPC service ports off untrusted networks
- Monitor integrity of cron-executed scripts on FortiSIEM appliances
- Subscribe to Fortinet PSIRT advisories for FortiSIEM
CVEs associated with Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
Weaknesses (CWE) in Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
Timeline of Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
- Context: Fortinet warns that practical exploit code for the earlier FortiSIEM flaw CVE-2025-25256 has been spotted in the wild (Help Net Security).
- Context: Fortinet publicly discloses and patches CVE-2025-64155 (FortiSIEM phMonitor, tcp/7900, CVSS 9.8), reported by Horizon3.ai.
- Context: Horizon3.ai releases a PoC for CVE-2025-64155; Defused reports in-the-wild exploitation attempts on 2026-01-16, a precedent for rapid weaponization of FortiSIEM PoCs.
- FortiSIEM 7.5.1 listed as the fixed release; FortiSIEM 7.6 and FortiSIEM Cloud are not affected; no virtual patch; restricting TCP 27918 given as workaround.
- CVE-2026-106173 published as a CWE-22 path traversal in FortiSIEM 7.5.0.
- Fortinet PSIRT publishes FG-IR-26-180 for CVE-2026-106173 (arbitrary file write in grpc phQueryMaster, CVSS 9.4); the flaw was identified internally by Fortinet's Product Security team (Gwendal Guégniaud).
- No in-the-wild exploitation, threat actor, or network IOC is reported by any source as of this analysis; the threat is tracked pending exploitation reports.
- The Hacker News reports the public exploit; Fortinet's advisory still states exploitation in the wild is not known and Horizon3.ai finds no application logs that reveal exploitation.
- Horizon3.ai publishes its deep-dive and public PoC (github.com/horizon3ai/CVE-2026-106173) overwriting the cron-run /opt/charting/redishb.sh via gRPC SendQueryResult path traversal plus NUL-byte injection.
Sources cited for Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path
- CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3.ai)
- Fortinet PSIRT FG-IR-26-180: Arbitrary file write in grpc phQueryMaster
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (The Hacker News)
- horizon3ai/CVE-2026-106173 PoC repository
- NVD: CVE-2026-106173
- The Hacker Wire: CVE-2026-106173
- SecurityOnline CVE Watchtower: CVE-2026-106173
- PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155) - Help Net Security
- CVE-2025-64155: In the Wild Exploitation of FortiSIEM for Unauthenticated Root-Level RCE (Greenbone)
Detection coverage for TL-2026-3976
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3976 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.