[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF_TytopkSoDJv1lPp1XEzMW4G7zXmMH7sjhwPadK1HM":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"833b0cc5-7596-4a47-b6c8-6957e024b0fb","Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution","critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-584d35","Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially","A critical path traversal vulnerability in Fortinet FortiSIEM, tracked as CVE-2026-106173, has a public proof-of-concept exploit available. The flaw allows unauthenticated attackers to achieve remote code execution by overwriting critical system files, such as a health check script, via crafted packets exploiting gRPC services.","Fortinet FortiSIEM critical path traversal flaw gets public exploit PoC for RCE.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcritical-fortisiem-flaw-gets-public.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg3BuJLxcpzxzxwpUcwsPb7L-gNCeXeyuPtNysOMHtf06VmANCx2DR3O52Puw9AQwUu0C8ccQ77MF_l0bAf4zL-hrvYO8jSHs6Km0Xz6-Q4yYm1thRvJ-y59qLRX9Qni0zD161qJ53oCgzEIo3NjOLKtgOrIAbOMsAhITOhL9qoy2v9D6tRU26m0fBoMDhJ\u002Fs1600\u002Ffort-poc.jpg","2026-10-20T15:38:52+00:00","2026-10-20T18:00:06.438623+00:00",9,[17,20,23,26],{"name":18,"type":19},"FortiSIEM","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"gRPC","technology",{"name":27,"type":28},"Horizon3.ai","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-106173","Critical path traversal vulnerability in FortiSIEM",[21,18],{"controls":54,"vendors":138},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":85,"product_name":106,"url":107,"description":108},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":110,"name":111,"problem":112,"products":113},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[139],{"slug":140,"name":21,"logo_path":141,"roles":142},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[143],"affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"public-poc-exploit-released-for-critical-fortisiem-rce-flaw","Public PoC Exploit Released for Critical FortiSIEM RCE Flaw","A critical path traversal vulnerability in Fortinet FortiSIEM (CVE-2026-106173) allows unauthenticated attackers to achieve remote code execution by overwriting system files through crafted packets targeting gRPC services. The availability of a public proof-of-concept exploit dramatically lowers the bar for attackers, meaning even less-skilled threat actors can now weaponize this flaw. Security monitoring infrastructure like SIEM platforms is a particularly high-value target because compromising it can blind defenders to ongoing attacks. Organizations running unpatched FortiSIEM instances are now at acute risk of full system compromise with no authentication required.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 17: Incident Response Management":159,"OWASP A06:2021 Vulnerable and Outdated Components":160,"CIS Control 7: Continuous Vulnerability Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 requires essential and important entities to implement vulnerability handling and patching policies; failure to patch a critical SIEM flaw with a public exploit violates this obligation and exposes operators to regulatory liability.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; an enforced remediation timeline for critical vulnerabilities would have driven immediate patching before exploit publication.","With a public PoC actively circulating, organizations need a tested incident response plan to rapidly detect, contain, and recover from potential exploitation of this FortiSIEM flaw.","The path traversal vulnerability represents a known flaw in an outdated component version; OWASP A06 highlights the organizational risk of running software without tracking and remediating known CVEs.","Regular vulnerability scanning and a defined patching cadence would have identified the unpatched FortiSIEM instance before a public PoC made exploitation trivial.","This control mandates timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch a publicly disclosed critical flaw in a security-critical system.","The vulnerability allows unauthenticated remote code execution, making enforcement of strict access controls and authentication requirements on gRPC services directly relevant to preventing exploitation."]