Summary
- CVE-2026-106173 was published on 13 October 2026.
- Fortinet assigns a CVSS v3.1 score of 9.4 to the path traversal issue.
- Several FortiSIEM release branches are affected; operators must match their versions to guidance.
Fortinet has disclosed a critical path traversal vulnerability in FortiSIEM, a platform used to collect, correlate and investigate enterprise security events. CVE-2026-106173 was published on 13 October 2026 and carries a CVSS v3.1 base score of 9.4 in the vendor's vulnerability record.
The record describes improper restriction of a pathname to a limited directory. Under the stated conditions, an attacker could submit specially crafted packets and cause unauthorised code or commands to execute. Fortinet's scoring vector lists network access, low attack complexity, no required privileges and no user interaction, with high potential effects on confidentiality, integrity and availability.
FortiSIEM deployments can contain sensitive operational information because they are designed to aggregate logs and other security events from many systems. They may also hold service connections and configuration data associated with the environments they monitor. A weakness in such a platform can therefore create risk beyond the application itself, depending on its access and privileges.
The vulnerability record identifies affected versions across multiple branches: 7.5.0, 7.4.0 through 7.4.2, 7.3.0 through 7.3.5, 7.2.0 through 7.2.7, 7.1.0 through 7.1.9, and 7.0.0 through 7.0.4. Operators should not infer that every FortiSIEM installation is vulnerable; the version inventory and the current Fortinet advisory determine which builds require action.
Path traversal weaknesses generally arise when a program accepts a path or file reference without enforcing the intended boundary around accessible locations. Depending on the affected processing route, exploitation may permit reading, writing or invoking resources outside the designed area. The CVE record explicitly describes unauthorised command execution in this FortiSIEM case, but does not supply evidence that attackers have exploited it in the wild.
Central monitoring platforms are often treated as trusted infrastructure. They may receive feeds from endpoints, network equipment, cloud systems and identity services, and are sometimes maintained separately from the workloads they observe. That combination places particular weight on administrative interfaces, segmentation and the privileges given to integrations.
The disclosure also presents a patching dependency: a security team may need to adjust or restart the very system it uses to monitor changes elsewhere. Maintenance plans must preserve the ability to detect events and retain logs, while isolating potentially exposed interfaces where possible. These considerations follow from the role of the platform; they are not claims that the new CVE has already caused lost logs or incidents.
Fortinet lists affected builds across several distinct release branches, making the precise installed version necessary for choosing a corrected build. A blanket instruction to install a single version would overlook compatibility and support requirements across deployments. Security platforms often receive extensive inputs from less-trusted sources, so the design of parsing and processing boundaries matters even when an operator keeps the main management console behind access controls. The CVE describes a network-reachable flaw with no privileges required under its scoring assumptions, but the public record does not describe the location of every affected interface. Detailed exposure decisions must therefore rely on the vendor's current advisory and the configuration of each installation rather than an assumption that all SIEM servers have equal external access.
The CVE record was published on 13 October by Fortinet as the assigning organisation. This provides a direct vendor statement about the weakness, affected branches and severity, whereas unrelated Fortinet vulnerabilities reported earlier in October concern different products. The FortiSIEM disclosure should therefore be tracked under its own identifier instead of rolled into older FortiMail or firewall advisories.
Fortinet's FG-IR-26-180 advisory provides the remediation details for individual release families, while the CVE record gives the affected ranges and technical class. The record does not name victims or establish active exploitation. The affected platform monitors other systems, so operators must account for potential disruption to security monitoring while applying a correction.
