HOC Shorts |
Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM, after functional Proof-of-Concept (PoC) exploit code was made publicly available.
- The Impact: Allows an unauthenticated remote attacker to execute arbitrary system commands on vulnerable FortiSIEM instances without user interaction.
- Mass Security Hardening Wave: Fortinet released coordinated security updates across FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, advising admins to apply patches before full technical details are disclosed in November.
- Active Exploitation Link: CISA added `CVE-2025-61624` to its Known Exploited Vulnerabilities (KEV) catalog following intelligence linking it to stealthy FortiGate implants deployed in telecommunications intrusions.
Critical Fortinet FortiSIEM Flaw (`CVE-2026-106173`) Exploit Released as Vendor Issues Mass Hardening Patches
Cybersecurity agencies, including Singapore’s Cyber Security Agency (CSA) and HKCERT, have issued security alerts after working exploit code was publicly released for a critical vulnerability in Fortinet FortiSIEM.
Tracked as `CVE-2026-106173`, the vulnerability reportedly has a CVSS v3.1 score of 9.8 out of 10. It could allow attackers to execute operating system commands without authentication, potentially gaining control of affected FortiSIEM appliances and compromising network monitoring systems.
Technical Breakdown of `CVE-2026-106173`
[Unauthenticated Attacker Command]
│
▼
[FortiSIEM 7.5.0 Command Injection Gateway]
│
▼
[Arbitrary Code Execution / System Privileges Granted]
│
▼
[Full SIEM Data Log Interception & Lateral Pivot]
1. Root Cause: The flaw lies in improper command sanitization within the management interface of FortiSIEM version `7.5.0`.
2. Exploitation Flow: An unauthenticated remote attacker transmits crafted network requests to the appliance HTTP/management interface. The system parses the unvalidated input directly into underlying shell execution routines.
3. Public Exploit Availability: With functional PoC scripts currently circulating across public vulnerability forums, automated threat scanning against exposed FortiSIEM endpoints is expected to escalate rapidly.
CISA KEV Addition: Telecom Hack Linked to Stealthy FortiGate Implant
In related threat intelligence, CISA formally added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog. Detailed in recent investigations by Palo Alto Networks, nation-state actors actively exploited the arbitrary file write flaw to install persistent, customized implants on FortiGate firewalls targeting telecommunications infrastructure.
Administrators are strongly advised to isolate management interfaces from public routing and execute immediate firmware upgrades across all perimeter appliances.
How the Fortinet Exploit (CVE-2026-106173) Works?
The exploit allows an unauthenticated hacker to take full control of a FortiSIEM server in 4 quick steps:
- No Password Needed (Authentication Bypass):
FortiSIEM runs a background network service called phQueryMaster (port 27918) with authentication checks turned off, allowing anyone on the internet to send commands without logging in. - File Path Manipulation (Path Traversal):
The service accepts a query-id input to write search results to disk. By injecting ../../ sequences, the attacker redirects the system to write files anywhere on the operating system. - Extension Bypass (Null-Byte Truncation):
The system automatically appends a .txt suffix to filenames. The attacker inserts a null byte (\0) into the filename, forcing the OS to ignore the .txt suffix and overwrite critical system files. - Execution via Cron Job Overwrite (Code Execution):
The attacker uses this flaw to overwrite an existing system health-check script (redishb.sh). Within 60 seconds, the system’s scheduled timer (cron) automatically runs the overwritten script, executing the attacker’s commands with full root/admin privileges.
Coordinated Mass Product Hardening
Fortinet has also announced a security update initiative for its major enterprise products ahead of detailed technical disclosures planned for November 10, 2026.
System administrators are advised to check their environments and update affected software to the recommended secure versions listed below.
| Product Platform | Vulnerable Version Range | Mandated Patch Release |
| FortiSIEM | Version 7.5.0 |
Upgrade to 7.5.1 or later |
| FortiOS | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12 |
Upgrade to 8.0.2, 7.6.8, or 7.4.13 |
| FortiManager | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11 |
Upgrade to 8.0.2, 7.6.8, or 7.4.12 |
| FortiAnalyzer | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11 |
Upgrade to 8.0.2, 7.6.8, or 7.4.12 |
| FortiMail | 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 |
Upgrade to 8.0.2, 7.6.7, or 7.4.9 |
Security Detection Guidance
- Immediate Remediation: Upgrade FortiSIEM deployments to version 7.5.1 or later (or fixed baseline releases detailed in Fortinet advisory FG-IR-26-180).
- Emergency Workaround: If immediate patching is not possible, apply strict firewall rules to block external and untrusted access to TCP port 27918.
- Forensic Auditing: Because standard application logs do not log this exploit path, security teams should inspect file modification timestamps across cron directories (/etc/cron*, /var/spool/cron) for modified scripts.
