Critical FortiSIEM flaw CVE-2026-106173 enables privileged file overwrite via gRPC

Fortinet has disclosed CVE-2026-106173, a critical path traversal vulnerability in the phQueryMaster service of its FortiSIEM security information and event management platform. The flaw lies in a gRPC interface on TCP port 27918, which builds file paths from caller-supplied query identifiers without adequate validation. Attackers could exploit it to overwrite a script that cron runs every minute with elevated privileges, granting code execution. Horizon3.ai has published a technical analysis and proof-of-concept, and Fortinet recommends upgrading to version 7.5.1 or later, or restricting access to the affected port in the interim. This is the third FortiSIEM vulnerability Horizon3 has reported, following two earlier flaws in a different service.