Fortinet published 10 advisories covering 13 bugs on Oct 13. Two are critical. FG-IR-26-180 / CVE-2026-106173 (CVSS 9.4) is a path traversal in FortiSIEM that may let an unauthenticated attacker run code or commands via crafted packets. Fix: upgrade 7.5.0 to 7.5.1+ (the CVE record also lists 7.0 through 7.4 as affected). Workaround: restrict access to TCP port 27918. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. FG-IR-26-185 / CVE-2026-107656 (CVSS 9.6) is an alternate-path authentication bypass in the FortiSandbox GUI via crafted HTTP requests. Fix: 5.0.0–5.0.6 to 5.0.7+, 4.4.0–4.4.9 to 4.4.10+. PaaS 4.4 must migrate to a fixed release, and 5.2 is not affected. Fortinet marks both Known Exploited: No. Fortinet bugs have a long history of fast exploitation after disclosure, so treat internet-exposed SIEM collectors and sandbox GUIs as patch-first. SecurityWeek also notes high-severity authenticated SQL injection fixes in FortiAnalyzer, FortiManager and FortiMail. Update Oct 20: Horizon3 published a root-cause write-up and a public PoC for CVE-2026-106173. The phQueryMaster gRPC service on TCP 27918 doesn't require client certificates, its SendQueryResult query-id allows path traversal, and a NUL byte gives an exact-path file overwrite. The PoC overwrites /opt/charting/redishb.sh, which cron runs every 60 seconds. Still not on CISA KEV and no exploitation reported. See the hunt.