CVE-2026-106173

What it is. Fortinet's advisory calls it an arbitrary file write in the grpc phQueryMaster service. Horizon3.ai's write-up says the SendQueryResult handler builds a file path from a client-supplied query ID without checking it, so an attacker can write outside the query results folder and overwrite existing files. Horizon3 says its exploit overwrites a script that a cron job runs every 60 seconds, which turns the file write into code execution. It also says the service uses TLS but does not ask clients for a certificate, so any client that can reach port 27918 can connect without credentials.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on systems your organization owns.

1. Is the server on 7.5.0? This decides exposure. Check the FortiSIEM version on each Supervisor, Worker and Collector. Only 7.5.0 is affected. 7.5.1 and later are fixed, and 7.6 is not affected.
2. Is TCP 27918 reachable from untrusted networks? Horizon3 says the service listens on all interfaces. On the appliance, this shows the listener.
   ss -tlnp | grep 27918
   From a host outside the trusted network, this tests whether the port answers.
   nc -vz <fortisiem-host> 27918
   A server that answers from the internet or a user network goes first.
3. Has the server already been touched? Horizon3 found no application logs that reveal exploitation and suggests comparing file timestamps instead, as described under what to look for in logs. Run that check on any 7.5.0 server that was reachable after October 20.

Public code. horizon3ai/CVE-2026-106173 was posted on October 20 with Horizon3's write-up, and several copies and rewrites followed. We read the README and write-up and did not run the code.

Upgrading to FortiSIEM 7.5.1 or later is the fix. Until then, Fortinet's advisory gives one workaround.

• Restrict access to TCP port 27918. Fortinet says this prevents the issue. Allow the port only from the FortiSIEM nodes that need it, and confirm from outside that it no longer answers. This only helps if every path to the port, including from user networks and VPN ranges, is closed.

Horizon3 says it found no application logs that reveal exploitation. These come from its write-up.

• Changed timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool that do not match the files around them. This lists them with full times.
  ls -l --time-style=full-iso /opt/charting/ /opt/phoenix/bin/phLicenseTool
• Other files with write times that stand out from their neighbors, since the flaw can overwrite any file the service can write.
• Connections to TCP 27918 from hosts that are not FortiSIEM nodes.

Is CVE-2026-106173 being exploited?

Canada's Cyber Centre said on October 23 that open-source reporting indicates it is being exploited in the wild. It did not name the reporter. Fortinet's advisory still lists it as not known to be exploited, and it is not on CISA KEV as of the November 6, 2026 catalog. A working public exploit has been available since October 20.

Which FortiSIEM versions are affected?

Only 7.5.0. Fortinet says 7.5.1 and later fix it, and 7.6 and FortiSIEM Cloud are not affected.

Is there a workaround?

Yes. Fortinet says restricting access to TCP port 27918 prevents the issue.

Does an attacker need credentials?

No. Fortinet describes it as unauthenticated, and Horizon3 says the gRPC service accepts connections without a client certificate.

How do we check whether a server was compromised?

Horizon3 says no application log shows it. Compare the timestamps of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool with the files around them, and look for other files with unexpected write times.

Nov 8, 2026. First published. Fixed in 7.5.1 since October 13; public exploit since October 20; Canada's Cyber Centre reports exploitation since October 23; not on CISA KEV.

• Fortinet PSIRT FG-IR-26-180, arbitrary file write in grpc phQueryMaster (Oct 13, 2026)
• Horizon3.ai technical write-up (Oct 20, 2026) and proof of concept (read only, not run)
• Canadian Centre for Cyber Security AV26-1037 (Oct 13, 2026, updated Oct 23, 2026)
• Singapore Cyber Security Agency alert AL-2026-153 (Oct 22, 2026)
• NIST NVD: CVE-2026-106173 (Awaiting Analysis, checked Nov 8)
• CISA Known Exploited Vulnerabilities catalog (checked the November 6, 2026 catalog release)