{
  "id": 15763308,
  "title": "Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution",
  "url": "https://urgent.news/2026/10/20/critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T15:38:52.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html"
  },
  "original_language": "en",
  "account": "Fortinet recently patched a critical security flaw in its FortiSIEM system that could allow unauthenticated attackers to execute arbitrary code remotely. The vulnerability, identified as CVE-2026-106173 and rated with a high CVSS score of 9.4, stems from a path traversal flaw in the gRPC service handling HTTP/2 and HPACK encoded data. By sending specially crafted packets to TCP port 27918, an attacker could overwrite existing files outside of the intended directory, effectively bypassing the system's intended file structure. This is due to the FortiSIEM gRPC QueryResultReq handler processing untrusted metadata without proper validation. Attackers exploit this by inserting directory traversal sequences, such as \"../\", and null bytes into the metadata, which the system's SendQueryResult() function inadvertently interprets as legitimate, allowing them to write arbitrary files to the file system. The issue is further exacerbated by the system's automatic addition of a default file name to the end of the attacker-controlled path, but this can be circumvented through careful crafting of the query-id parameter. Once the attacker has successfully overwritten an existing file, such as the Redis health check script, they can maintain the original file's permissions and ownership. Alternatively, a second exploitation method involves creating a new file with an explicitly chosen name.",
  "summary": "Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}