Canada's Cyber Centre updated its Fortinet advisory on 23 October 2026 to warn that CVE-2026-106173, a critical vulnerability in Fortinet's FortiSIEM security platform, is being exploited in the wild.

What the flaw does

The vulnerability, rated CVSS 9.4 by Fortinet and 9.8 in the National Vulnerability Database record, lets an unauthenticated attacker write files and run code through the gRPC service of the phQueryMaster daemon, which handles metadata without proper path validation. FortiSIEM collects security data across entire networks, so taking it over would give an attacker a view of everything defenders see.

Horizon3 published full technical details and a public proof-of-concept exploit on GitHub after Fortinet patched the flaw on 13 October. The service listens on TCP port 27918, and Horizon3 found that any remote client could connect without a client certificate. Fortinet's own advisory carries an exploit-maturity rating meaning functional exploit code exists, although CISA has not yet added the flaw to its Known Exploited Vulnerabilities catalogue.

What defenders should do

Affected versions include FortiSIEM 7.5.0 and older branches down to 7.0.0; the fix is in 7.5.1 and later, and 7.6 is not affected. Operators should upgrade, restrict access to port 27918 to trusted management networks only, and look for odd file timestamps, since Horizon3 notes no application logs reveal the attack.

The warning is about reported exploitation, not a list of named victims, and the scale of attacks is not yet established. But with exploit code public and a national cyber centre confirming in-the-wild activity, unpatched internet-facing FortiSIEM installations should be treated as urgently at risk.