FortiSIEM SendQueryResult RCE (CVE-2026-106173)

CVE-2026-106173 Horizon3: unauthenticated SendQueryResult gRPC write to /opt/charting/redishb.sh with CMD payload; phxctl.service executes within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM gRPC file write → delayed RCE via phxctl.service. """ from future impo...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Cybersecurity researchers have released a proof-of-concept PoC exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 CVSS score: 9.4, is a critical path traversal flaw that...