FortiSIEM SendQueryResult RCE (CVE-2026-106173)

CVE-2026-106173 Horizon3: unauthenticated SendQueryResult gRPC write to /opt/charting/redishb.sh with CMD payload; phxctl.service executes within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM gRPC file write → delayed RCE via phxctl.service. """ from future impo...

FortiSIEM Phoenix Monitor RCE (CVE-2025-64155)

CVE-2025-64155 Horizon3: Phoenix Monitor clusterurl injection writes CMD payload to /opt/charting/redishb.sh; phxctl.service runs within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2025-64155 — FortiSIEM Phoenix Monitor clusterurl injection → delayed RCE. Reference:...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

FortiSIEM Phoenix Monitor Port Probe (CVE-2025-64155)

Checks whether TCP 7900 Phoenix Monitor TLS is reachable on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM Phoenix Monitor TLS port CVE-2025-64155.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner,...

FortiSIEM gRPC HTTP/2 Probe (CVE-2026-106173)

Probes FortiSIEM gRPC TCP 27918: TLS with ALPN h2 or plaintext HTTP/2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM gRPC surface CVE-2026-106173.""" from kittysploit import from lib.protocols.http2.http2client import Http2client from lib.protocols.tcp.tcpscannerclient import...

Ashwesker-CVE-2025-64155

🔒 CVE-2025-64155: Critical FortiSIEM Vulnerability 📌 Overview CVE-2025-64155 is a critical security vulnerability in Fortinet FortiSIEM , a popular security information and event management platform. Publicly disclosed on January 13, 2026 , it allows unauthenticated remote attackers to execute...

CYBERDUDEBIVASH-FortiSIEM-CVE-2025-64155-Scanner

CYBERDUDEBIVASH FortiSIEM CVE-2025-64155 Scanner Authorized high-impact tool from CYBERDUDEBIVASH ECOSYSTEM to detect CVE-2025-64155 FortiSIEM phMonitor Command Injection. Scans for open ports and vulnerable behaviors ethically. Features Port check for TCP/7900 Optional safe probe for handler...

watchTowr-vs-FortiSIEM-CVE-2025-25256

watchTowr-vs-FortiSIEM-CVE-2025-25256 Detection Artifact Generator for FortiSIEM CVE-2025-25256 https://github.com/user-attachments/assets/1aa1040a-af34-460d-8844-1e440efa9ba1 See our blog post for technical details Detection in Action python watchTowr-vs-FortiSIEM-CVE-2025-25256.py -r...

CVE-2024-23108

CVE-2024-23108: Fortinet FortiSIEM Unauthenticated 2nd Order Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2023-34992

CVE-2023-34992: Fortinet FortiSIEM Unauthenticated Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2026-106173

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File Write RCE This repository contains a proof of concept for CVE-2026-106173, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM. Vulnerability Details The FortiSIEM gRPC QueryResultReq handler processes untrusted...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

CVE-2025-64155

CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution Proof of concept exploit for Fortinet FortiSIEM which abuses an argument injection to write a file to gain code execution as root Blog Post Deep-dive analysis here: Horizon3.ai - CVE-2025-64155: Three Years of Remotely...

CVE-2026-106173

CVE-2026-106173 — FortiSIEM Path Traversal Vulnerability Overview This repository documents CVE-2026-106173 , a reported path traversal vulnerability affecting Fortinet FortiSIEM. Path traversal vulnerabilities occur when an application fails to properly validate file paths, potentially allowing ...

Exploit for CVE-2026-106173

CVE-2026-106173 — FortiSIEM QueryResult gRPC Path-Traversal Fi...

Exploit for CVE-2026-106173

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File W...

Fortinet FortiSIEM 7.5.0 Path Traversal

Fortinet FortiSIEM version 7.5.0 contains a path traversal flaw in phQueryMaster that allows unauthenticated arbitrary file writes and execution of unauthorized code or commands via specially crafted packets. https://packetstorm.news/download/237290...

VulnCheck KEV: CVE-2026-106173

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...

Exploit for CVE-2026-106173

CVE‑2026‑106173 – FortiSIEM phQueryMaste...

FortiSIEM gRPC Code Execution

The vulnerability of the gRPC request handler QueryResultReq in the security management system FortiSIEM is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using specially crafted packets...