- Horizon3.ai says CVE-2026-106173 lets an unauthenticated attacker write files to a FortiSIEM server, and that this can lead to code execution as the admin user.
- Horizon3 found no application logs that clearly show the attack, so teams may need to check file timestamps by hand.
- Confirm the server is patched per Fortinet's advisory, limit access to port 27918, and watch scheduled scripts for unexpected changes.
A network service that does not ask who is calling
On October 13, 2026, Fortinet published an advisory for FortiSIEM. The flaw is CVE-2026-106173. It allows an arbitrary file write through a gRPC service. Horizon3.ai, a security research firm, published a technical analysis on October 20. It calls the issue a critical vulnerability.
The idea worth holding onto is simple. A service that listens on a network should check who is calling before it acts. According to Horizon3, this one does not.
The service is called phQueryMaster. It listens on port 27918 and uses gRPC. That is a common way for one program to call functions in another over a network. Horizon3 says the service listens on every network interface.
A gRPC server can ask callers for a client certificate, which works like a visitor badge. Horizon3 found that this server turns that requirement off. Any remote client can connect without presenting a certificate.
From a file write to running code
Horizon3 says the service has a command that handles incoming results. That command does not properly validate a value supplied by the caller. As a result, an unauthenticated attacker can write data to a location of their choosing on the server.
A file write alone is not code execution. Horizon3 closed that gap by using a script that FortiSIEM already runs on a schedule. A cron job, which is a timer-based task runner, invokes the script every 60 seconds. The admin user context the attack operates in can write to it.
By overwriting that script, Horizon3 demonstrated code execution. The attacker's commands run on their own within about a minute. No password is needed at any step.
Horizon3 has published a proof of concept on GitHub. This article does not reproduce the technical steps.
Little trace is left behind
Horizon3 says it found no application logs that would explicitly reveal exploitation. Its advice is to inspect file modification timestamps. If a script was overwritten, its timestamp may not match the files around it.
That makes detection a manual check, not an alert that fires on its own. Teams that rely only on logs may have nothing to review.
A new service in a familiar product
This is not Horizon3's first look at FortiSIEM. The firm says it has disclosed several critical vulnerabilities in the product over the years. They include CVE-2023-34992, CVE-2024-23108 and CVE-2025-64155.
Horizon3 says all of that earlier research involved the phMonitor service on port 7900. This new bug sits in a different service on port 27918, one the firm says it had never examined before.
What it could mean for a monitoring server
The next paragraph is this publication's inference, not something Horizon3 demonstrated. Horizon3 showed file writes and code execution as the admin user. It did not show an attacker blinding FortiSIEM or altering what it reports.
Still, a monitoring server holds data and tooling that a security team relies on. Code execution on such a system could let an attacker tamper with them. That is a reason to treat this patch with care.
Questions for your security team
Has FortiSIEM been updated according to Fortinet's October 13 advisory? Who confirmed it, and when?
Is port 27918 reachable from anywhere beyond the systems that need it? Horizon3 says the service listens on every interface, so network rules matter.
Does anyone check scheduled scripts on the FortiSIEM host for unexpected changes? Horizon3 found no log that would flag this attack, so file timestamps are the signal it points to.
The wider lesson is a familiar one. The tools built to watch everything need broad access, so every door into them deserves a lock.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Horizon3.ai.
