home / blog
2026-10-13 · critical
FortiSIEM: path traversal leading to command execution (CVE-2026-106173)
Path traversal in FortiSIEM 7.5.0 with possible unauthorised command execution, CVSS 9.8. Apply the Fortinet fix.
On 13 October 2026 the record for CVE-2026-106173 was published, a path traversal in Fortinet FortiSIEM 7.5.0. According to NVD, specially crafted packets may allow a remote unauthenticated attacker to run unauthorised commands or code. The CVSS v3.1 score is 9.8.
The flaw stems from improper limitation of a pathname to a restricted directory (CWE-22). FortiSIEM collects logs from many devices, so an exposed instance can be an entry point into the monitoring network.
Apply the fix described in Fortinet advisory FG-IR-26-180, checking the installed version. In the meantime, restrict access to FortiSIEM interfaces and review logs for unusual requests to management paths.
At a glance
- What
- Path traversal in FortiSIEM 7.5.0. Specially crafted packets may lead to unauthorised command or code execution.
- Severity
- CVSS v3.1 9.8 (critical), according to NVD. The record has no CVSS v4.0 score.
- Cause
- Improper limitation of a pathname to a restricted directory (CWE-22).
- Fix
- Fixed versions are listed in Fortinet advisory FG-IR-26-180. Compare them with your own version on the bulletin.
- Action
- Apply the fix and restrict access to FortiSIEM interfaces from untrusted networks.
Sources: NVD, CVE-2026-106173 · Fortinet PSIRT, FG-IR-26-180