# Fortinet FortiSIEM CVE-2026-106173 gRPC phQueryMaster Path Traversal Enables Unauthenticated RCE (Public PoC)

> A critical path traversal flaw in the FortiSIEM phQueryMaster gRPC service (TCP 27918) lets an unauthenticated remote attacker write arbitrary files and achieve code execution on FortiSIEM 7.5.0. Horizon3.ai published a technical deep-dive and public PoC on 2026-10-20; Fortinet states exploitation in the wild is not known. Fixed in FortiSIEM 7.5.1.

- **Published:** 2026-10-20T18:09:08Z
- **Last reviewed:** 2026-10-20T18:09:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3976
- **ID:** TL-2026-3976
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-106173, CVE-2025-64155

## Description

CVE-2026-106173 (Fortinet PSIRT FG-IR-26-180, CWE-22) affects the phQueryMaster gRPC service of FortiSIEM 7.5.0. The service is implemented in libphGrpcServices.so and listens on [::]:27918 (the port is derived from command_port 7918 via phSecureUtils::getGrpcPort()). Horizon3.ai reports that the gRPC server does not request a client certificate (sslOps.client_certificate_request stays 0, GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE), so no authentication is required. Fortinet's Product Security team (credited to Gwendal Guégniaud) found the flaw internally and published the advisory on 2026-10-13.

The vulnerable handler is the SendQueryResult RPC (grpcNotificationService.cpp), a client-streaming call that receives QueryResultReq messages. It trusts request metadata fields query-id, src-ip, period-start and period-end. The server builds the output directory by string concatenation (/query/result/<query-id>) and the filename as result-<src-ip>-<period-start>-<period-end>-<id>.dat, without validating query-id. Two bugs are chained: (1) path traversal, where a query-id such as ../../../../../tmp/x escapes the query directory; and (2) NUL-byte injection, where the server copies values using client-declared lengths so an embedded \0 survives gRPC's HTTP/2 and HPACK encoding. When the path reaches the OS it truncates at the NUL, which discards the server-appended .dat suffix and gives the attacker exact control over the destination filename. Standard gRPC libraries and curl refuse NUL bytes in headers, so exploitation requires manual gRPC message assembly; a two-request variant is needed to create brand-new files with exact names.

Horizon3.ai's weaponization overwrites /opt/charting/redishb.sh, a shell script that performs Redis health checks and is run by cron every 60 seconds. The overwritten file keeps its original owner and permissions, so the payload runs as the cron job owner (the admin user context). Execution is blind with roughly 60 seconds of latency. A secondary candidate target noted is /opt/phoenix/bin/phLicenseTool. The public PoC (github.com/horizon3ai/CVE-2026-106173, CVE-2026-106173.py, 2 commits) supports -t target, -c command, -p port (default 27918), --plaintext (HTTP/2 without TLS) and --dry-run.

Detection is difficult: Horizon3.ai found no application logs that explicitly reveal exploitation. Suggested hunting signals are unexpected modification or timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool that are inconsistent with neighbouring files, and gRPC connections to TCP 27918 from unexpected sources. Because FortiSIEM is a security monitoring platform, a compromise gives an attacker a foothold on the defender's own visibility infrastructure.

Scoring and scope differ between sources. Fortinet rates the issue CVSS 3.1 9.4 (vector includes temporal metrics E:H/RL:O/RC:C), lists only FortiSIEM 7.5.0 as affected with 7.5.1 or above as the fix, and states FortiSIEM 7.6 and FortiSIEM Cloud are not affected; no virtual patch is available. An earlier collection of this record noted an NVD entry with a 9.8 base score and a broader CPE list (7.0.x-7.4.x), which does not match Fortinet's advisory; the NVD page could not be re-fetched in this pass, so the vendor statement is used as authoritative. Fortinet states exploitation is not known. No threat actor, malware, or network IOCs are named in any source.

Context for prioritization: Horizon3.ai has previously published other FortiSIEM research targeting the phMonitor service on tcp/7900 (CVE-2023-34992, CVE-2024-23108, CVE-2025-64155); this is the first public analysis of phQueryMaster. For CVE-2025-64155, a Horizon3.ai PoC released on 2026-01-15 was followed by in-the-wild exploitation attempts reported by Defused on 2026-01-16, and CVE-2025-25256 had practical exploit code spotted in the wild per Fortinet in August 2025. Defenders should treat a public PoC for a FortiSIEM flaw as a short-fuse exploitation precursor, although no such activity is reported for CVE-2026-106173.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1053.003 Cron
- T1053.003 Cron
- T1565.001 Stored Data Manipulation

## Sources

- [CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3.ai)](https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/)
- [Fortinet PSIRT FG-IR-26-180: Arbitrary file write in grpc phQueryMaster](https://fortiguard.fortinet.com/psirt/FG-IR-26-180)
- [Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (The Hacker News)](https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html)
- [horizon3ai/CVE-2026-106173 PoC repository](https://github.com/horizon3ai/CVE-2026-106173)
- [NVD: CVE-2026-106173](https://nvd.nist.gov/vuln/detail/CVE-2026-106173)
- [The Hacker Wire: CVE-2026-106173](https://www.thehackerwire.com/vulnerability/CVE-2026-106173/)
- [SecurityOnline CVE Watchtower: CVE-2026-106173](https://securityonline.info/cve-watchtower/cve-2026-106173/)
- [PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155) - Help Net Security](https://www.helpnetsecurity.com/2026/01/15/fortisiem-vulnerability-cve-2025-64155-poc-exploit/)
- [CVE-2025-64155: In the Wild Exploitation of FortiSIEM for Unauthenticated Root-Level RCE (Greenbone)](https://www.greenbone.net/en/?p=62886)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3976