Vulnerability in Fortinet FortiSIEM

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)
• Critical severity: CVSS 9.8

[ Description ]Official description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL16 Oct 2026NCSC-2026-0434

  Vulnerabilities fixed in Fortinet FortiSIEM Translated from Dutch

  Probability/damage M/HCVE-2026-106173CVE-2026-106176
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3934

  Fortinet FortiSIEM: Multiple vulnerabilities allow code execution Translated from German

  CVE-2026-106176CVE-2026-106173

[ References ]References

• fortiguard.fortinet.com/psirt/FG-IR-26-180
• github.com/horizon3ai/CVE-2026-106173