CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCE

A closer look at CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCE

What this Horizon3 writeup covers

This page is a technical deep-dive by Horizon3 into CVE-2026-106173, a FortiSIEM vulnerability in a gRPC service that allows unauthenticated path traversal, arbitrary file writes, and potential code execution. It explains how the vulnerable gRPC service is exposed on tcp/27918 and how the SendQueryResult RPC is abused to control file paths and contents.

How the exploit works in practice

The researchers found the phQueryMaster component runs a gRPC server bound to [::]:27918 and that the server does not require client certificates, so remote clients can connect unauthenticated. The SendQueryResult handler uses unvalidated query-id and src-ip values to build file paths by simple string concatenation, enabling directory traversal. By embedding a null byte in the metadata length fields, the server’s appended filename suffix (result-... .dat) can be dropped, allowing an attacker to write to or overwrite an exact filesystem path. Horizon3 explains both single-request overwrite and a two-request technique to create a new file with an exact name.

Who will find this useful

Security engineers responsible for FortiSIEM instances, incident responders, and system administrators will find the technical details useful for understanding exploitation vectors and indicators. The post points to specific files and behaviors to check (for example recurrently executed scripts like /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool) and notes that file modification timestamps are worth inspecting if exploitation is suspected.

Questions people ask about CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCE

Does the gRPC service require client certificates to connect?

No - the server sets the client certificate option to false so remote clients can connect unauthenticated to tcp/27918.

How does an attacker control the written filename?

The server normally appends a fixed suffix result----.dat, but an attacker can include a null byte in the declared metadata length so the OS sees only the path before the null and the suffix is dropped, enabling exact-path writes or overwrites.

What artifacts should I check for signs of exploitation?

Inspect file write and modification timestamps for unexpected changes, and check scripts that are regularly executed such as /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool for unauthorized modifications.

CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCE was shared on NexURLs by Nexis on October 21, 2026, in Tech & AI.