Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a critical security flaw impacting Fortinet FortiSIEM. The vulnerability, tracked as CVE-2026-106173, could allow an unauthenticated attacker to execute unauthorized code or commands.
This critical path traversal flaw has a CVSS score of 9.4. The exploit enables unauthenticated remote code execution, posing a significant risk to systems utilizing FortiSIEM.
By the numbers
- CVSS score
- 9.4
Sources and references
Original report
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 008XQ1F2
Cite this
APA
Interestana AI Editorial. (2026, October 20). FortiSIEM Critical Flaw Exploitable Remotely. Interestana. https://interestana.com/articles/critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-execution-008xq1f2
MLA
“FortiSIEM Critical Flaw Exploitable Remotely.” Interestana, 20 Oct. 2026, interestana.com/articles/critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-execution-008xq1f2.
Chicago
Interestana AI Editorial. “FortiSIEM Critical Flaw Exploitable Remotely.” Interestana, October 20, 2026. https://interestana.com/articles/critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-execution-008xq1f2.
BibTeX
@misc{interestana_008xq1f2,
author = {{Interestana AI Editorial}},
title = {{FortiSIEM Critical Flaw Exploitable Remotely}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/critical-fortisiem-flaw-gets-public-exploit-poc-for-unauthenticated-remote-code-execution-008xq1f2},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html}
}Credit the source
Original reporting: The Hacker News, “Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution”, https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe