What allows unauthenticated remote code execution on FortiSIEM via port 27918?

The short version

• An unauthenticated gRPC service in Fortinet FortiSIEM allows arbitrary file writes via path traversal.
• Researchers from Horizon3 showed how null-byte handling bypasses filename restrictions to enable remote code execution.
• The flaw affects the phQueryMaster service listening on port tcp/27918, which binds to all interfaces.

The details

Fortinet published a security advisory on 13 October 2026 regarding a critical vulnerability in its FortiSIEM product, identified as CVE-2026-106173. This flaw permits arbitrary file writes through a misconfigured gRPC service. According to Horizon3 researchers, the issue stems from how the phQueryMaster service handles incoming requests on port tcp/27918. The service binds to every available network interface and does not require client certificates or any form of authentication for connections.

The core vulnerability lies in the `SendQueryResult` RPC method. The handler constructs file paths using attacker-controlled values, specifically the `query-id` and `src-ip`. Because the code concatenates these inputs without validation, an attacker can use directory traversal sequences, such as `../../../../../tmp/x`, to escape the intended query directory. This grants the attacker control over the target directory for the file write operation.

While the server appends a fixed filename pattern to the path, Horizon3 demonstrated that this limitation can be bypassed. The server copies header values based on the length declared by the client, allowing an attacker to embed a null byte within the `query-id`. When the operating system processes this path, it treats the null byte as the string terminator, effectively discarding the server's appended filename suffix. This technique allows an attacker to overwrite existing files in place or create new files with precise names, leading to remote code execution.

The context

Horizon3 has previously disclosed several critical vulnerabilities in FortiSIEM, including command injection flaws in the phMonitor service on port tcp/7900. This latest finding targets a different component, the phQueryMaster service, which researchers had not previously examined. The advisory highlights the risks of exposing internal services without proper access controls, particularly when those services handle file operations based on external input.

Next steps

Teams should verify if their FortiSIEM instances are exposed to untrusted networks on port tcp/27918. Network segmentation should restrict access to this gRPC service to trusted internal hosts only. Monitor for unusual file creation or modification events in system directories, particularly those involving the `result-` filename pattern. Review firewall rules to ensure that external traffic cannot reach the management and query interfaces of the SIEM appliance.

What defenders should look for

Security operations teams should monitor for unexpected outbound connections from FortiSIEM appliances to unknown external IPs, which may indicate data exfiltration or command-and-control activity. Look for anomalous file system activity, such as new files appearing in temporary or system directories with names matching the `result-` pattern. Check for process spawns that do not originate from standard service accounts or scheduled tasks. Investigate any sudden changes in file permissions or ownership, particularly for critical configuration or binary files. If suspicious activity is detected, isolate the affected system from the network immediately to prevent lateral movement.

What to do and how to stay safe

• Restrict network access to port tcp/27918 to trusted internal subnets only

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.