Path Traversal vulnerability affecting Fortinet FortiSIEM
A critical vulnerability affecting Fortinet FortiSIEM would allow an unauthenticated attacker to execute unauthorized code or commands on affected systems.
Description
Technical context and vulnerability details
FortiSIEM is a security information and event management (SIEM) solution developed by Fortinet, designed to provide comprehensive visibility and analysis of security threats. This product is affected by a vulnerability labeled CVE-2026-106173 resulting from incorrect limitation of a path to a restricted directory. Exploitation of this vulnerability would allow an unauthenticated attacker to execute unauthorized code or commands via sending specially crafted packets. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Data privacy breach;
- System and data integrity breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- FortiSIEM version 7.5.0;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update FortiSIEM to patched version or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.