1. Executive summary
A public proof-of-concept exploit has been released for CVE-2026-106173, a path traversal flaw in Fortinet FortiSIEM that an unauthenticated attacker can use to execute arbitrary code or commands. NVD scores it 9.8 CRITICAL (CWE-22); the source article quotes 9.4, and the verified score governs. The CVE is not in CISA KEV and EPSS records 0%, so there is no confirmed in-the-wild exploitation, but a working public exploit against an unauthenticated RCE in a SIEM platform is a short path from proof-of-concept to opportunistic scanning. FortiSIEM sits on the log and event pipeline, so a compromised instance exposes the telemetry that detection depends on, not just the appliance itself. EMEA financial services firms running FortiSIEM, whether on-premises or as a managed service, should treat internet-exposed instances as the priority.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24 | A public exploit exists for an unauthenticated RCE in a SIEM platform that sits in the detection and monitoring path. | Firms must include the FortiSIEM estate in their digital operational resilience testing scope, and a public exploit is grounds to bring that testing forward rather than wait for the annual cycle. |
| DORA Art. 28 | FortiSIEM is frequently delivered and operated as an ICT third-party or managed service. | Where a provider runs the instance, the firm must confirm the provider has assessed and patched CVE-2026-106173, and hold the provider to that under the contractual provisions. |
3. Technical analysis & attack chain
The vulnerability is a path traversal (CWE-22) in FortiSIEM that an unauthenticated attacker can reach to execute unauthorized code or commands. The source does not name the affected FortiSIEM versions, the vulnerable component, or the exact request path, and Fortinet's own advisory is not among the material available here. What is confirmed is the classification, the unauthenticated remote code execution outcome, and the existence of a public proof-of-concept.
Confirmed steps, as far as the source supports them:
- The attacker sends a crafted request to a reachable FortiSIEM interface. The source does not specify the protocol, port, or endpoint.
- The path traversal lets the request escape its intended directory context.
- The result is execution of unauthorized code or commands without authentication.
The source stops there. It gives no payload detail, no persistence mechanism, no command-and-control, no lateral movement and no post-exploitation behaviour. Any advisory that fills those gaps for this CVE is inventing them.
The mechanism matters to defenders because path traversal in an appliance web interface is the same class of flaw seen in the FortiMail zero-day covered in the related material (CVE-2026-104286, path traversal plus NULL byte handling allowing arbitrary file write via crafted HTTP or HTTPS requests). That is a different product and a different CVE, and it is not evidence about FortiSIEM. It is relevant only as a pattern: Fortinet appliance web interfaces have been the entry point for file-write-to-code-execution chains this year, and the same defensive posture applies.
Confidence caveat: the entire technical description of CVE-2026-106173 rests on a single source, The Hacker News, which itself summarises a researcher PoC release. The affected version range, the vulnerable endpoint and the PoC's reliability are all unconfirmed here. Verify against Fortinet's PSIRT advisory before scoping remediation.
4. Mitigation & containment
P1 within 24 hours:
- Inventory every FortiSIEM instance, including managed and cloud-delivered deployments, and record which are reachable from the internet. Internet-exposed instances are the exposure that matters for an unauthenticated flaw.
- Remove internet reachability from the FortiSIEM management interface. Restrict access to trusted management networks or a VPN, and block the interface at the perimeter firewall where it cannot be moved immediately.
- Apply the Fortinet fix for CVE-2026-106173. The source confirms the flaw is "recently patched" but does not give the fixed version numbers; take them from the Fortinet PSIRT advisory for the branch you run.
P2 within 72 hours:
- Hunt the FortiSIEM estate for signs of traversal attempts and post-exploitation in web and application logs, focusing on requests containing encoded path sequences (
../,%2e%2e, double-encoded variants) against the management interface. - Where a managed service provider operates FortiSIEM, obtain written confirmation of patch status and exposure from the provider, and record it against the third-party risk file.
P3 within 7 days:
- Add the FortiSIEM management interface to the external attack surface monitoring scope so a re-exposure is caught.
- Review whether SIEM telemetry has a gap if any instance was isolated during remediation, and confirm log forwarding from network and endpoint sources is intact.
5. Indicators of compromise
No indicators of compromise available in the source material. The source gives no hashes, IP addresses, domains, file paths or request strings for CVE-2026-106173, and the PoC itself is not reproduced here. The related FortiMail material carries its own IOCs in Fortinet's advisory, but those belong to CVE-2026-104286 and must not be applied to FortiSIEM.
6. Detection
Insufficient indicators to author detection rules. The source provides no distinctive strings, file paths, command-line flags, mutex names or network artefacts specific to CVE-2026-106173. A rule built on the CVE identifier or the product name would detect reporting about the flaw, not exploitation of it. Once Fortinet publishes request-level detail or the PoC's payload strings, rules can be written against them.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-106173 | 9.8 Critical | — | 0% | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may… |
7. Sources
- The Hacker News, "Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution", 2026-10-20. https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
- NVD, CVE-2026-106173 (CVSS 9.8, CWE-22). https://nvd.nist.gov/vuln/detail/CVE-2026-106173
- SecurityWeek, "Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action" (related context, CVE-2026-104286). https://www.securityweek.com/exploited-fortinet-fortimail-zero-day-calls-for-urgent-action/
- The Register, "Fortinet sounds the alarm over actively exploited FortiMail zero-day", 2026-10-02 (related context). https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803
- ANSSI CERT-FR, "Vulnérabilité dans Fortinet FortiMail", CERTFR-2026-AVI-1257, 2026-10-02 (related context). https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1257/
8. Adverse Trace position
Adverse Trace assesses CVE-2026-106173 as 9.8 CRITICAL per NVD, not in CISA KEV, with EPSS at 0%: no confirmed exploitation, but a public unauthenticated RCE exploit against a SIEM platform is a material exposure for any client with an internet-reachable instance. The technical detail is single-sourced and thin, so we are not raising this to active-campaign status and we are not attributing it to any actor; no MITRE ATT&CK profile applies. We will monitor Fortinet's PSIRT advisory for the fixed version matrix and any exploitation reporting, and will issue an update if KEV status or EPSS changes. Clients should confirm FortiSIEM inventory and internet exposure to us this week so we can prioritise the estate.
Published via PulseTrace — Adverse Trace threat intelligence.