CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fortinet FortiSIEM 7.5.0: unauthenticated phQueryMaster path traversal to code execution (CVSS 3.1 9.4); fixed in 7.5.1, workaround restrict tcp 27918, published 2026-10-13, no exploitation listed

cve · CVE-2026-106173 single-source

Coverage
1
first 2026-10-23 → last 2026-10-23
Latest activity
2026-10-23
FortiSandbox GUI auth bypass (9.6) and FortiSIEM 7.5.0 pre-auth code execution (9.4) fixed; no exploitation…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-106173, newest first. Check the date before acting on an older one.

  • Check every FortiSandbox that was upgraded to 5.0.6 or 4.4.9 after the exploited-flaw advisories of this year: those builds are still affected by CVE-2026-107656 and need 5.0.7 or 4.4.10; on FortiSIEM 7.5.0 install 7.5.1, or until then restrict access to tcp 27918 as Fortinet's workaround says.
    2026-10-23CVE-2026-107656 +1

Defender insights

What each entry about CVE-2026-106173 tells a defender to do, newest first.

2026-10-23NOTABLEFortiSandbox GUI auth bypass (9.6) and FortiSIEM 7.5.0 pre-auth code execution (9.4) fixed; no exploitation listed

Exposure · detection

Story timeline

  1. 2026-10-23Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited
    trending-vulnerabilitiesFortiSandbox GUI auth bypass (9.6) and FortiSIEM 7.5.0 pre-auth code execution (9.4) fixed; no exploitation listed

Hunting pivots

Affected products
Fortinet FortiSIEMFortinet FortiSandboxFortinet FortiSandbox PaaS
Tags
auth-bypasspatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-23/fortinet-fortisandbox-fortisiem-pre-auth-critical-fixes · ATT&CK page ↗

Entries about Fortinet FortiSIEM 7.5.0: unauthenticated phQueryMaster path traversal to code execution (CVSS 3.1 9.4); fixed in 7.5.1, workaround restrict tcp 27918, published 2026-10-13, no exploitation listed (1)

2026-10-23 · view entry permalink →

NOTABLECVE-2026-107656 +1NATOA2

Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited

Fortinet's PSIRT published two critical advisories for security-operations products on 2026-10-13. FG-IR-26-185 describes an authentication bypass through an alternate path or channel in the FortiSandbox GUI that a remote unauthenticated attacker can trigger with crafted HTTP requests, listed as CVE-2026-107656 with CVSS 3.1 9.6 and an impact of unauthorized code or command execution (Fortinet PSIRT FG-IR-26-185, 2026-10-13). FG-IR-26-180 describes a path traversal in the FortiSIEM phQueryMaster service ("arbitrary file write in grpc phQueryMaster") that lets an unauthenticated attacker execute unauthorized code or commands through specially crafted packets, listed as CVE-2026-106173 with CVSS 3.1 9.4 (Fortinet PSIRT FG-IR-26-180, 2026-10-13). Both pages state that neither flaw is known to be exploited, and both carry temporal vector strings with an exploit-code maturity of functional (FortiSandbox) and high (FortiSIEM) that the advisories do not explain (Fortinet PSIRT FG-IR-26-185, 2026-10-13; Fortinet PSIRT FG-IR-26-180, 2026-10-13).

For FortiSandbox, versions 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9 are affected and 5.0.7 and 4.4.10 fix it; 5.2 is not affected; FortiSandbox PaaS 5.0.0 through 5.0.6 is affected, and every PaaS 4.4 version must migrate to a fixed release (Fortinet PSIRT FG-IR-26-185, 2026-10-13). The ranges include 5.0.6 and 4.4.9 (Fortinet PSIRT FG-IR-26-185, 2026-10-13). Defused reported exploitation of three FortiSandbox flaws in June, CVE-2026-39813, CVE-2026-39808 and CVE-2026-25089 (Help Net Security, 2026-06-16), and the build that fixes CVE-2026-25089 is 5.0.6 on the 5.0 branch and 4.4.9 on 4.4 (Fortinet PSIRT FG-IR-26-141, 2026-06-09), so a unit patched for that flaw is not patched for this one. For FortiSIEM only 7.5.0 is affected and 7.5.1 fixes it; 7.6 and FortiSIEM Cloud are not affected, and Fortinet's workaround is to restrict access on tcp port 27918 (Fortinet PSIRT FG-IR-26-180, 2026-10-13).

may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests

Fortinet PSIRT (FG-IR-26-185) 2026-10-13

may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets

Restricting access on tcp port 27918 prevents the issue.

Fortinet PSIRT (FG-IR-26-180) 2026-10-13

Builds on: Defused reports exploitation of three pre-auth FortiSandbox flaws and CISA lists two in KEV… · Fortinet ships out-of-cycle critical and high fixes for FortiOS and four more products; CVEs…

vulnerability23 Oct 04:25Zsingle-sourceOpen finding →
Sources: Fortinet PSIRT (FG-IR-26-185) · Fortinet PSIRT (FG-IR-26-180) · Help Net Security · Fortinet PSIRT (FG-IR-26-141)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • fortiguard.fortinet.com3 (75%)
  • helpnetsecurity.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)