CVE-2026-106173

Executive Summary

CVE-2026-106173 is a path traversal vulnerability (CWE-22) in Fortinet FortiSIEM 7.5.0, caused by improper limitation of a pathname to a restricted directory. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting a network-reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact. Because FortiSIEM is a security operations and SIEM platform, successful exploitation could allow unauthorized code or command execution within a sensitive monitoring and correlation environment.

Technical Analysis

The vulnerability is classified as an improper limitation of a pathname to a restricted directory, a path traversal condition tracked as CWE-22. In this class of flaw, an application fails to properly sanitize or constrain user-supplied path input, allowing an attacker to reference files or locations outside the intended restricted directory using traversal sequences or equivalent path-manipulation techniques. The NVD description states that FortiSIEM 7.5.0 may allow an attacker to execute unauthorized code or commands via specially crafted packets.

The attack surface is network-accessible, as indicated by the CVSS vector (AV:N) and the reference to specially crafted packets. The vector further specifies low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), meaning the flaw can be triggered remotely without authentication or victim action. The impact subscore is uniformly high across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with the potential to execute unauthorized code or commands on or through the affected platform.

At the vulnerability-class level, path traversal weaknesses typically arise when an application accepts an externally supplied path or filename component and concatenates or resolves it against a base directory without canonicalization and boundary checks. Successful traversal can lead to access or inclusion of files outside the intended scope, which in turn may enable logic bypass, data exposure, or — as the description suggests here — execution of unauthorized code or commands. The provided data does not disclose the specific endpoint, parameter, function, or file path involved, and no such specifics are asserted here. Documentation of the exact request structure, packet format, and traversal payload requires consultation of the Fortinet PSIRT advisory and any associated technical write-ups once available.

Because the description explicitly references specially crafted packets, the triggering vector is network-based. This aligns with an externally reachable interface of the FortiSIEM deployment. However, the precise protocol, service, or component receiving the crafted packets is not identified in the provided data, and no implementation-specific details should be assumed beyond the vulnerability class.

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE, and it is not listed in CISA KEV. The EPSS score has not yet been assigned by FIRST.org, so no exploitation-likelihood metric can be cited at this time.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level. No public PoC is available; the sequence below is inferred from the CWE-22 classification and the NVD description, and intentionally avoids inventing endpoints, parameters, or function names.

1. Reconnaissance / target identification: An attacker identifies internet-facing or reachable FortiSIEM 7.5.0 deployments. Because the flaw is network-reachable with no authentication required, the attacker only needs network access to the affected service to attempt exploitation. Discovery may leverage version fingerprinting of the FortiSIEM web interface or management services.

2. Triggering the flaw class: The attacker sends specially crafted packets containing path input that includes traversal sequences or equivalent path-manipulation constructs. The application fails to restrict the resolved pathname to the intended restricted directory, allowing the input to escape the intended boundary. No authentication or user interaction is required per the CVSS vector (PR:N, UI:N).

3. Payload / execution method: Per the NVD description, successful exploitation "may allow attacker to execute unauthorized code or commands." At the vulnerability-class level, traversal that escapes a restricted directory can be chained toward inclusion or invocation of attacker-influenced content, leading to unauthorized command or code execution. The exact mechanism by which traversal escalates to command execution is not specified in the available data and is not fabricated here.

4. Post-exploitation impact: Given the high confidentiality, integrity, and availability impact (C:H/I:H/A:H), a successful attacker could read sensitive data, alter system state or data, and disrupt availability. As FortiSIEM is a SIEM/security operations platform, compromise could expose correlated security telemetry, credentials, and monitoring data, or enable manipulation of security visibility — a high-value outcome for an adversary.

Risk factors elevating urgency: critical CVSS (9.8), unauthenticated network reachability, and the sensitive role of the affected product. Compounding risk: no patch evidence from tracked sources and no known workaround in the provided data.

Impact Assessment

Business impact is severe. A CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates: remote exploitability (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The scope is unchanged (S:U), meaning impact is confined to the vulnerable component's security authority, but within that authority the consequences are maximal.

Affected systems are FortiSIEM 7.5.0 deployments. Because FortiSIEM aggregates and correlates security events, compromise can have a blast radius beyond the appliance itself: telemetry integrity, detection fidelity, and downstream trust in the SIEM may be affected. Exposure is greatest for deployments that are internet-facing or reachable from untrusted network segments. In environments where FortiSIEM holds credentials, integration tokens, or configuration for other security controls, downstream lateral movement or abuse becomes plausible.

No EPSS score is available, and the CVE is not in CISA KEV, so exploitation likelihood cannot be quantitatively asserted. The absence of public PoC reduces — but does not eliminate — near-term exploitation risk. Organizations should treat this as high priority given the critical rating and unpatched status in tracked sources.

Detection Guidance

Sigma Rule

title: Potential FortiSIEM Path Traversal Exploitation Attempt (CVE-2026-106173)
id: 3b1c9f2a-7d4e-4a6b-9c21-8f0e5d2a1b77
status: experimental
description: Detects HTTP requests containing directory traversal sequences targeting FortiSIEM, consistent with CWE-22 exploitation attempts against CVE-2026-106173.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106173
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
  condition: selection_method and selection_traversal
falsepositives:
  - Legitimate application behavior that includes traversal-like strings
  - Security scanners and vulnerability assessment tools
level: high
tags:
  - attack.t1190
  - cve.2026-106173

YARA Rule

rule CVE_2026_106173_FortiSIEM_PathTraversal
{
    meta:
        description = "Detects directory traversal payload patterns associated with CVE-2026-106173 (FortiSIEM path traversal)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106173"
        date = "2026-01-01"
        severity = "high"

    strings:
        $t1 = "../" ascii
        $t2 = "..\\" ascii
        $t3 = "..%2f" ascii nocase
        $t4 = "..%5c" ascii nocase
        $t5 = "%2e%2e%2f" ascii nocase
        $t6 = "%2e%2e/" ascii nocase
        $t7 = "....//" ascii

    condition:
        uint16(0) == 0x4854 or any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106173 FortiSIEM Path Traversal Exploitation Attempt"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; content:"../" nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; reference:cve,2026-106173; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106173; sid:2026106173; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and http.request.method in ("GET", "POST")]
  [network where network.protocol == "http" and
     (http.request.method in ("GET", "POST")) and
     (url.query : "*../*" or url.query : "*..%2f*" or url.query : "*%2e%2e%2f*" or url.query : "*..%5c*")]

Splunk SPL Query

index=web (sourcetype=access_combined OR sourcetype=fortinet:fortisiem OR sourcetype=*proxy*)
| eval uri=coalesce(uri, url, cs_uri)
| where match(uri, "(?i)(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e/|\.\.\.\.//)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, dest_ip, http_method
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,fortisiem,attack,cve-2026-106173">
  <rule id="1061730" level="12">
    <if_sid>31100</if_sid>
    <id>^404$</id>
    <url>\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e/</url>
    <description>CVE-2026-106173: Possible FortiSIEM path traversal exploitation attempt (CWE-22) from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106173,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is available in the provided data.

1. Immediate mitigations:

   • Restrict network access to FortiSIEM services and interfaces. Do not expose FortiSIEM management or web interfaces directly to the internet; place them behind a hardened reverse proxy or VPN and enforce IP allow-listing.
   • Apply network segmentation and firewall rules to limit which hosts can reach FortiSIEM components, reducing the attack surface for network-based exploitation.
   • Deploy the detection rules above (Sigma, Suricata, Elastic, Splunk, Wazuh) to monitor for traversal attempts, and alert on anomalous access patterns targeting the FortiSIEM interface.
   • Increase monitoring and logging on FortiSIEM and adjacent infrastructure; review for outbound connections, unexpected process execution, or configuration changes.

2. Patch/upgrade steps:

   • No fixed version is identified in tracked sources. Monitor Fortinet PSIRT advisories and the Fortinet support portal closely for an official advisory and patched release for FortiSIEM 7.5.0.
   • When a fixed release becomes available, test in a staging environment and schedule expedited deployment given the critical rating. Verify the vendor advisory for the exact fixed version and any required migration steps.

3. Long-term hardening:

   • Maintain an asset inventory that flags internet-facing security appliances and ensures they are covered by a prioritized patch management program.
   • Enforce least-privilege network access and zero-trust segmentation around SIEM and security-operations infrastructure.
   • Implement continuous vulnerability scanning and configuration monitoring for FortiSIEM deployments.
   • Adopt secure input validation and canonicalization standards in any custom integrations or content developed for FortiSIEM.
   • Track CISA KEV and EPSS updates; if EPSS scoring or KEV listing changes, reassess remediation priority immediately.

References

• NVD — CVE-2026-106173: https://nvd.nist.gov/vuln/detail/CVE-2026-106173
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Fortinet PSIRT advisories (monitor for the official FortiSIEM advisory): https://www.fortiguard.com/psirt
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106173 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE. No exploit-in-the-wild evidence or associated threat actor campaign has been identified in the provided data, and the CVE is not listed in CISA KEV.