FortiSIEM Path Traversal Flaw Can Allow Code Execution

What happened

Fortinet has addressed a path traversal vulnerability in FortiSIEM 7.5.0. Think of it like a delivery instruction that should keep a package inside a designated room but instead lets it reach somewhere outside that boundary. In software, path traversal means a pathname is not properly confined to the directory it is supposed to stay within.

The vulnerability, CVE-2026-106173, may allow an attacker to execute unauthorized code or commands by sending specially crafted packets. That makes the potential consequence more serious than simply reaching an unintended directory: the flaw could let an attacker cause the affected system to perform unauthorized operations.

Fortinet's advisory identifies 7.5.0 as affected and 7.5.1 and later as the fixed versions. NVD published its entry on 2026-10-13 and records a CVSS 3.1 score of 9.8, rated CRITICAL. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-22.

Technical details

The weakness is path traversal, classified as CWE-22. A directory boundary is supposed to limit where a pathname can lead. The underlying problem here is that FortiSIEM 7.5.0 does not properly enforce that restriction, allowing a crafted pathname to escape its intended scope.

The described attack uses specially crafted packets and may result in unauthorized code or command execution. Packets are units of data sent across a network. The description does not establish a particular service, packet format, authentication requirement, or required user interaction, so developers should avoid assuming those details.

CVSS, the Common Vulnerability Scoring System, expresses the technical severity of a vulnerability. NVD records a CVSS 3.1 score of 9.8 with a CRITICAL rating for CVE-2026-106173. That rating supports prioritizing the update, but it does not establish whether a particular deployment is reachable by an attacker or whether exploitation has occurred.

For developers reviewing the issue, the central boundary is between a pathname that stays within an allowed directory and one that can lead outside it. The disclosed consequence is unauthorized execution, but the description does not explain the internal sequence connecting the pathname handling problem to that outcome.

Weakness types: Path traversal

Who is affected

Everyday users

For everyday users, the practical question is whether an organization you rely on operates the affected FortiSIEM version. The affected product is FortiSIEM 7.5.0; this advisory does not identify a personal browser or everyday desktop application that users need to update themselves.

If your workplace manages FortiSIEM, the relevant action belongs with its IT or security administrators. You can pass along the product name and CVE-2026-106173 so they can check the deployment. The advisory alone does not establish that your account, device, or information has been affected.

Developers

Developers who support a FortiSIEM deployment should help identify whether 7.5.0 is running and coordinate the move to 7.5.1 and later. An application change elsewhere should not be treated as a substitute for updating the affected product.

The broader engineering lesson is to treat directory restrictions as an enforced boundary, rather than an expectation about how a pathname will be used. For this specific vulnerability, however, the disclosed information does not identify a source file, function, or application-level workaround. Keep remediation tied to Fortinet's advisory.

Server and IT admins

Server and IT administrators should prioritize checking FortiSIEM installations for 7.5.0. The combination of a CRITICAL severity rating and possible unauthorized code or command execution makes confirming the installed version and arranging the vendor update a practical priority.

The affected-version entry identifies 7.5.0, with 7.5.1 and later listed as fixed. Use the vendor advisory to resolve questions about deployments outside that entry rather than extending its scope by assumption. An update should be followed by confirmation that the intended fixed version is actually running.

What to do now

1. Identify the FortiSIEM installations your team manages and confirm their running versions.
2. Match any installation running 7.5.0 to CVE-2026-106173 and assign responsibility for its update.
3. Review Fortinet's advisory for the applicable update instructions and any deployment-specific requirements.
4. Upgrade affected FortiSIEM installations to 7.5.1 and later, and follow the update steps in the vendor's advisory.
5. Confirm the running version after the update and record the result so the team can distinguish completed remediation from work still pending.

If you can't update yet

• If the update must wait, check the vendor advisory for guidance on restricting access to the affected FortiSIEM deployment.
• Check the vendor advisory for guidance on reducing internet exposure while you arrange the update. Treat access restrictions as temporary risk reduction rather than confirmation that the flaw is fixed.

How to confirm the fix

• Confirm that each affected FortiSIEM installation is running 7.5.1 and later, rather than relying only on an update being scheduled or an installer finishing.
• Review the vendor advisory and confirm that its applicable update steps have been completed.
• Check your deployment inventory for any remaining FortiSIEM 7.5.0 installations and keep those entries open for remediation.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 1 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Fortinet advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-180
• NVD: CVE-2026-106173
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 22, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.