Security researchers have released proof-of-concept code targeting a critical vulnerability in Fortinet's FortiSIEM platform. The flaw, identified as CVE-2026-106173, carries a CVSS severity score of 9.4 and enables unauthenticated remote code execution. The exploit was made public following Fortinet's release of patches earlier this month.
The vulnerability stems from a path traversal issue within FortiSIEM's web interface. Attackers can leverage this weakness to bypass authentication mechanisms and inject malicious code without requiring valid credentials. The proof-of-concept demonstrates how relatively straightforward exploitation could be, raising concerns among enterprise security teams who rely on FortiSIEM for security monitoring and incident response.
The published exploit targets FortiSIEM's handling of file path inputs within its administrative web portal. By crafting specially formatted requests containing directory traversal sequences, attackers can access restricted system files and ultimately achieve arbitrary code execution on affected servers. Security researchers noted that the vulnerability affects FortiSIEM versions prior to the latest patched releases, specifically versions 5.6.0 through 5.6.2 and 6.1.0 through 6.1.1. The exploit requires no prior authentication, making it particularly dangerous for organizations with exposed FortiSIEM instances.
Fortinet has released security updates addressing CVE-2026-106173 across all supported FortiSIEM versions. Security teams are strongly advised to apply these patches without delay, especially for deployments accessible via the internet. Organizations unable to patch immediately should consider implementing network-level restrictions to limit access to FortiSIEM web interfaces. Additionally, monitoring for suspicious requests containing path traversal patterns can help detect potential exploitation attempts.
What versions of FortiSIEM are affected by CVE-2026-106173? The vulnerability impacts FortiSIEM versions 5.6.0 through 5.6.2 and 6.1.0 through 6.1.1. Organizations running these versions should upgrade to the latest patched releases immediately.
Can this vulnerability be exploited remotely without credentials? Yes, the flaw allows unauthenticated attackers to execute arbitrary code remotely through the web interface, making it critical for exposed systems.
Are there any workarounds if patching is not immediately possible? Organizations should restrict network access to FortiSIEM web interfaces and implement web application firewall rules to block requests containing path traversal patterns.