Executive SummaryRisk level: Critical
What happened

A critical path traversal vulnerability in Fortinet’s FortiSIEM was discovered, allowing unauthenticated remote code execution.

Who is affected

Organizations utilizing FortiSIEM versions with the CVE-2026-106173 vulnerability are at risk, particularly those not applying the latest patches.

Why it matters

This flaw poses a significant threat, enabling attackers to execute arbitrary commands remotely, potentially leading to full system compromise.

Immediate recommended actions

  • Apply the latest security patches from Fortinet immediately.
  • Review access controls and limit exposure of FortiSIEM interfaces.
  • Conduct a thorough review of logs for any suspicious activity.
  • Implement network segmentation to limit potential attack vectors.
  • Enhance monitoring for indicators of exploitation attempts.

Key Technical Findings

Vulnerability

CVE-2026-106173 – Critical path traversal vulnerability leading to arbitrary code execution.

Affected Systems

Fortinet FortiSIEM versions prior to the latest patch release.

Initial Access Vector

Remote access through unauthenticated requests to the FortiSIEM interface.

Execution Method

Arbitrary code execution via crafted HTTP requests exploiting the vulnerability.

Persistence

Not specified in the source material.

Privilege Escalation

Not specified in the source material.

Defense Evasion

Not specified in the source material.

Credential Access

Not specified in the source material.

Lateral Movement

Not specified in the source material.

Data Exfiltration

Not specified in the source material.

Impact Level

Critical – potential complete system compromise and unauthorized access to sensitive data.

Technical Background

The vulnerability identified as CVE-2026-106173 presents a critical path traversal flaw within Fortinet’s FortiSIEM. This flaw allows attackers to bypass authentication mechanisms and execute arbitrary commands on affected systems. Exploitation requires no prior authentication, making it particularly dangerous for organizations that do not secure their FortiSIEM interfaces adequately. Attackers leveraging this vulnerability can gain extensive control over system functionalities, which may lead to further escalation of privileges or lateral movement within the network.

FortiSIEM is a security information and event management (SIEM) solution designed to provide comprehensive visibility into IT infrastructure. The primary objective of exploiting this vulnerability would typically include gaining unauthorized access, deploying additional malicious payloads, or exfiltrating sensitive information. The lack of adequate security controls on the exposed interfaces makes it imperative for organizations to implement strict access controls and continuous monitoring to mitigate potential threats.

Attack Chain Analysis

  1. Initial Access

    ActivityUnauthenticated requests are sent to the FortiSIEM interface to exploit the path traversal vulnerability.

    EvidenceLogs indicating unusual HTTP request patterns or access attempts from unusual IP ranges.

    TelemetryWeb server access logs and application logs from FortiSIEM.

    Detection opportunityImplementing alerts for anomalous access patterns can help detect initial exploitation attempts.

  2. Execution

    ActivityExecution of arbitrary commands as a result of successfully exploiting the vulnerability.

    EvidenceCommand execution logs showing unexpected activities or processes initiated from the FortiSIEM application context.

    TelemetrySystem event logs and process creation logs.

    Detection opportunityMonitoring for anomalous command executions linked to FortiSIEM processes can reveal exploitation activity.

Deep Technical Behavior Analysis

Exploitation Mechanism Overview

The exploitation mechanism for CVE-2026-106173 primarily revolves around manipulating HTTP requests to traverse directories. Once an attacker successfully sends crafted requests, they can invoke functionalities that should be protected by authentication checks. This could allow for arbitrary command execution on the underlying operating system hosting FortiSIEM. Attackers may use base64 encoding or similar techniques to obfuscate their payloads within HTTP requests to evade simplistic detection mechanisms. Potential — requires validation of specific payloads used in attack scenarios is necessary for thorough understanding.

Post-Exploitation Behavior

After gaining access through this vulnerability, attackers might deploy additional tools or scripts to establish persistence or further exploit the environment. Given that there is no direct indication of persistence mechanisms through this specific CVE, attackers may rely on existing system services or configurations to maintain their foothold in the environment. Potential — validation is required on how attackers could leverage existing configurations for persistence without being detected. The breadth of exploitation possibilities emphasizes the need for vigilant monitoring and robust access controls following any potential breach event.

Indicators of Compromise

No indicators of compromise were provided in the source material.

Indicators of Behavior

Behavioral Indicator Description Data Source Confidence
Unauthorized Access Attempts Anomalous HTTP requests targeting FortiSIEM interfaces indicating attempts to exploit vulnerabilities. Web server access logs Potential

Detection Engineering Guidance

T1071.001 — Application Layer Protocol: Web Protocols
  • ObjectiveDetect anomalies in web traffic that may indicate exploitation attempts.
  • Suspicious patternUnusual HTTP request patterns or parameters indicative of exploitation attempts.
  • Data sourceWeb server logs and SIEM data from FortiSIEM.
  • False positivesNo common false positives noted; however, normal maintenance activities may generate noise.
  • ResponseInvestigate any alerts triggered by anomalous requests and validate against known patterns.
index=web_logs (http_request=







Platform
Log Source
What to Look For
Priority






Endpoint
EDR / Defender telemetry
Process tree, persistence, tamper attempts
High




Web
Web server access logs
Anomalous POSTs, new endpoints, web-shell-like requests
High




Web
Web server error logs
Repeated 403/404/500 bursts on single endpoints
Medium




Identity
IdP / VPN logs
Impossible travel, spraying, MFA fatigue
High




Network
DNS resolver logs
Rare/high-entropy domains, tunneling
Medium




Network
Proxy / firewall logs
Beaconing, direct-IP C2, exfil volume
High






MITRE ATT&CK Mapping






Tactic
Technique ID
Technique Name
Relevance
Detection Opportunity
Confidence







T1071.001

Relevant to the analyzed activity.
Monitor associated telemetry (see Detection Engineering).
Reported






Incident Response Guidance


    

  • Validate exposure and confirm whether the issue applies to your environment.
    • 

  • Preserve evidence (memory, disk, relevant logs) before remediation.
    • 

  • Isolate affected hosts/accounts if compromise is suspected.
    • 

  • Collect volatile data and review the log sources listed above.
    • 

  • Hunt for the indicators of behavior and any related atomic indicators.
    • 

  • Rotate potentially exposed credentials, keys, and session tokens.
    • 

  • Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
    • 

  • Patch affected systems; reimage where integrity cannot be assured.
    • 

  • Run post-remediation validation and a BAS/security-validation retest.
    • 



Remediation and Hardening


    

  • Patch affected systems and reduce internet-exposed services.
    • 

  • Enforce MFA and least-privilege for privileged and remote access.
    • 

  • Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
    • 

  • Restrict script execution and constrain LOLBins where feasible.
    • 

  • Monitor persistence locations and disable unnecessary services.
    • 

  • Segment critical assets and review privileged accounts.
    • 

  • Rotate secrets and remove credentials from configuration files.
    • 

  • Tune SIEM/EDR detections, then validate controls after changes.
    • 



Business Risk


    

  • Service disruption: degraded or unavailable systems during compromise or recovery.
    • 

  • Data exposure: risk to sensitive, regulated, or customer data depending on scope.
    • 

  • Regulatory exposure: potential breach-notification and compliance obligations.
    • 

  • Financial impact: incident response, downtime, and potential extortion costs.
    • 

  • Brand and trust impact: reputational damage with customers and partners.
    • 

  • Identity blast radius: compromised accounts can expand access across cloud and SaaS.
    • 



Executive Takeaway




What leadership needs to know: Reducing exposure and improving detection coverage limits impact. Current assessed risk: Not specified.


Prioritise: patching/exposure reduction, identity hardening (MFA, least privilege), and detection coverage for the techniques above.


Validate after remediation: re-test controls with breach & attack simulation to confirm the relevant techniques are now prevented or detected.

Validate your defenses against this attack

The techniques in this article map directly to Valitrix validation modules — test your own controls against them:

  • Endpoint Security Validation

    Verify your EDR, XDR and AV controls actually detect the endpoint techniques used by this threat.

  • SIEM Validation

    Confirm your SIEM and detection rules fire on the attack behaviors covered in this article.

  • BAS testing

    Safely replay the same attack techniques against your own environment — non-disruptive and evidence-based.

#arbitrary code execution#Breach and Attack Simulation#CVE-2026-106173#cybersecurity#FortiSIEM#MITRE ATT&CK#Remote Code Execution#security validation platform#vulnerability analysis

Written by

Valitrix

Valitrix writes for Valitrix on continuous Breach and Attack Simulation, MITRE ATT&CK-aligned validation, and hardening security controls across endpoint, email, and network surfaces.

Back to all posts