CVE-2026-106173: critical vulnerability in Fortinet FortiSIEM
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
72Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a public proof of concept.
ssvc Actcvss 9.4epss 1.0%
from disclosure to weapon7 days
Published on NVDOct 13
1st PoC+7d
VulnCheck+10d
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 20 Oct 2026Boletim do CISC de Vulnerabilidadesread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
Affected products
Fortinet · FortiSIEMpublic PoCs found — 9
cve_referencegithub.com/horizon3ai/CVE-2026-106173★ 36githubgithub.com/tc4dy/CVE-2026-106173-PoC-Exploit★ 5githubgithub.com/MRdark-ops/rce-FortiSIEM★ 2githubgithub.com/0xredash/CVE-2026-106173★ 2githubgithub.com/0xBlackash/CVE-2026-106173★ 2githubgithub.com/aduli198/CVE-2026-106173★ 0vulncheckvulncheck.com/xdb/4a00a52aef98unverifiedvulncheckvulncheck.com/xdb/5d93dac2fb52unverifiedvulncheckvulncheck.com/xdb/f4323aae2d7aunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiSIEM
In the same product, most dangerous first.