CVE-2026-106173

🚨 FORTINET OCT 13: CRITICAL FORTISANDBOX AUTH BYPASS (CVSS 9.6) + FORTISIEM UNAUTH RCE (CVSS 9.4) Fortinet’s Product Security team published critical advisories on Oct 13, 2026 as part of its October PSIRT batch. • CVE-2026-107656 (FG-IR-26-185) — FortiSandbox GUI authentication bypass via alternate path (CWE-288), CVSS 9.6. Remote unauthenticated attacker can gain unauthorized access through crafted HTTP requests. • Affected: FortiSandbox / PaaS 5.0.0–5.0.6 → upgrade to 5.0.7+; 4.4.0–4.4.9 → 4.4.10+ (4.4 PaaS: migrate). FortiSandbox 5.2 not affected. • CVE-2026-106173 (FG-IR-26-180) — FortiSIEM path traversal enabling unauthenticated code execution, CVSS 9.4. Affects FortiSIEM 7.5.0 only → upgrade to 7.5.1+ (or restrict TCP 27918). FortiSIEM 7.6 and FortiSIEM Cloud not affected. • Fortinet states no known exploitation for either critical at publication. • Same day batch also covers High/Medium issues in FortiAnalyzer, FortiManager, FortiMail, and FortiOS. ⚠️ Analyst Note: Official Fortinet PSIRT advisories (not a dark-web claim). Prioritize patching internet-reachable FortiSandbox management UIs and FortiSIEM collectors exposing the phQueryMaster port. Primary: https://www.fortiguard.com/psirt/FG-IR-26-185 Also: https://fortiguard.fortinet.com/psirt/FG-IR-26-180 #DDW #DarkWeb #Fortinet #FortiSandbox #FortiSIEM #CVE #ThreatIntelligence #CyberSecurity

CVE advisory: CVE-2026-106173 - fortinet: Arbitrary file write in grpc phQueryMaster. https://vulnipulse.com/advisories/fortinet-fg-ir-26-180 #CVE #CyberSecurity #Fortinet #FortiSIEM

#NØØT_Security_Alerts 🚨 #ALERT — FORTINET FORTISIEM: CRITICAL UNAUTHENTICATED REMOTE CODE EXECUTION RISK October 13, 2026 DISCLOSED BY: Fortinet PSIRT PRODUCT: Fortinet FortiSIEM CVE: CVE-2026-106173 SEVERITY: CRITICAL — Fortinet CVSS 9.4 WEAKNESS: CWE-22 — Path Traversal AFFECTED VERSIONS: FortiSIEM 7.5.0 FortiSIEM 7.4.0–7.4.2 FortiSIEM 7.3.0–7.3.5 FortiSIEM 7.2.0–7.2.7 FortiSIEM 7.1.0–7.1.9 FortiSIEM 7.0.0–7.0.4 IMPACT: A path-traversal vulnerability could allow an unauthenticated remote attacker to execute unauthorized code or commands by sending specially crafted network packets. Successful exploitation could compromise the confidentiality, integrity and availability of affected FortiSIEM systems. EXPOSURE: Requires network reachability to the vulnerable functionality. Fortinet’s CVSS assessment specifies low attack complexity, no required privileges and no user interaction. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL CODE EXECUTION VULNERABILITY. No confirmed exploitation in the wild or independently verified working public PoC established. CISA’s October 13 vulnerability enrichment classifies exploitation as “none,” automatable as “yes,” and potential technical impact as “total.” This is NOT evidence of actual compromise. Forensic triage: Identify externally reachable FortiSIEM services. Review unexpected application crashes, suspicious network requests, unauthorized file changes and unexplained processes originating from FortiSIEM services. Preserve relevant appliance and network logs. No confirmed CVE-specific malicious IOCs have been published. URGENT ACTION: Prioritize remediation of exposed FortiSIEM deployments. Fortinet identifies FortiSIEM 7.5.1 and 7.6.0 as fixed release targets. Also listed: FortiSOC 26.2.2. FortiSIEMCloud 25.4.1. Verify release availability and the appropriate upgrade path before deployment. Restrict unnecessary network exposure and investigate suspicious activity. SOURCE: https://fortiguard.fortinet.com/psirt/FG-IR-26-180 OFFICIAL CVE RECORD: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106173.json CONFIDENCE: HIGH — Fortinet-authored CVE record confirms the vulnerability, affected releases, potential code execution and remediation targets. UNVERIFIED — Active exploitation, public working exploit and victim compromise. #CyberSecurity #ThreatIntel #Fortinet #FortiSIEM #RCE #VulnerabilityManagement

🚨 CRITICAL — CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.… CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-106173 #Fortinet #CyberSecurity #InfoSec