Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Fortinet FortiSIEM
Incident: Public release of a PoC for an unauthenticated RCE vulnerability in FortiSIEM.
Impact: Complete system compromise through arbitrary code execution.
Attacker: Unidentified threat actors
Analysis: The flaw, CVE-2026-106173, leverages a combination of path traversal and null-byte injection within the gRPC service to overwrite system files. By targeting a specific health check shell script executed by a cron job, attackers can achieve unauthenticated remote code execution. The release of a public PoC significantly lowers the barrier for exploitation.
Recommendations: Immediately upgrade FortiSIEM to version 7.5.1 or higher.; Restrict network access to TCP port 27918 to known, trusted IP addresses.; Audit system logs for unauthorized file modifications in the /opt/charting/ directory.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source