Public attack code now exists for a serious Fortinet security flaw

Researchers have released working attack code for a serious flaw in Fortinet FortiSIEM. The flaw lets a stranger run commands on the system without logging in. Fortinet released patches last week, but public attack code gives criminals a head start against anyone who has not installed them.

What the flaw is

FortiSIEM is a tool that collects and analyzes security logs from a company's systems. The flaw is tracked as CVE-2026-106173 and scores 9.4 out of 10 for severity. It is a path traversal bug, which means an attacker can trick a program into reaching folders it was never meant to touch. Specially crafted packets of data can trigger it.

How the attack works

Horizon3.ai, the security firm that published the code, says an attacker connects to a service listening on TCP port 27918 and overwrites an existing file outside its intended folder. The program normally adds its own file name, which limits the attacker. A second trick gets around that. A hidden null byte, a special character that marks the end of text, makes the system ignore the added file name.

The example target is a script that checks the health of a Redis service. A scheduled job runs it every 60 seconds. Overwrite that script, and the attacker's commands run on their own. "The write lands on the exact path that preceded the null byte," said Zach Hanley of Horizon3.ai. A second method uses two requests to create a brand-new file with an exact name.

Who should act

Anyone running FortiSIEM is affected, including businesses that rely on an IT provider or security vendor to manage it. The source article lists the patched versions, but that list is not included in the material here. Fortinet's own notice is the place to confirm which version is safe.

What is not known yet

• Whether attackers are already using the flaw against real targets.
• How many FortiSIEM systems are exposed and unpatched.
• Which exact versions are fixed, as the list is missing from the source text.

What to do

Ask whoever manages FortiSIEM whether the update from last week is installed. If it is not, make it a priority. Public attack code usually means attempts to break in follow soon after.