---
title: Fortinet October PSIRT: critical FortiSIEM unauth code execution (CVE-2026-106173) and FortiSandbox GUI auth bypass (CVE-2026-107656) | ctxsec
url: https://ctxsec.com/items/fortinet-oct-2026-fortisiem-fortisandbox
description: ""
status: "confirmed (vendor), last updated Oct 20, 2026, 12:05 PM ET"
published: 2026-10-13
updated: 2026-10-20T12:05:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/fortinet-oct-2026-fortisiem-fortisandbox.md)

confirmed (vendor)

2026-10-13 · updated

Oct 20, 2026, 12:05 PM ET

### Fortinet October PSIRT: critical FortiSIEM unauth code execution (CVE-2026-106173) and FortiSandbox GUI auth bypass (CVE-2026-107656)

Fortinet published 10 advisories covering 13 bugs on Oct 13. Two are critical. **FG-IR-26-180 / CVE-2026-106173** (CVSS 9.4) is a path traversal in FortiSIEM that may let an unauthenticated attacker run code or commands via crafted packets. Fix: upgrade 7.5.0 to 7.5.1+ (the CVE record also lists 7.0 through 7.4 as affected). Workaround: restrict access to TCP port 27918. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. **FG-IR-26-185 / CVE-2026-107656** (CVSS 9.6) is an alternate-path authentication bypass in the FortiSandbox GUI via crafted HTTP requests. Fix: 5.0.0–5.0.6 to 5.0.7+, 4.4.0–4.4.9 to 4.4.10+. PaaS 4.4 must migrate to a fixed release, and 5.2 is not affected. Fortinet marks both _Known Exploited: No_. Fortinet bugs have a long history of fast exploitation after disclosure, so treat internet-exposed SIEM collectors and sandbox GUIs as patch-first. SecurityWeek also notes high-severity authenticated SQL injection fixes in FortiAnalyzer, FortiManager and FortiMail. **Update Oct 20:** Horizon3 published a root-cause write-up and a **public PoC** for CVE-2026-106173. The phQueryMaster gRPC service on TCP 27918 doesn't require client certificates, its `SendQueryResult` query-id allows path traversal, and a NUL byte gives an exact-path file overwrite. The PoC overwrites `/opt/charting/redishb.sh`, which cron runs every 60 seconds. Still not on CISA KEV and no exploitation reported. See the [hunt](/hunting#hunt-fortisiem-cve-2026-106173-poc).

Sources: [FortiGuard FG-IR-26-180](https://fortiguard.fortinet.com/psirt/FG-IR-26-180) · [FortiGuard FG-IR-26-185](https://www.fortiguard.com/psirt/FG-IR-26-185) · [SecurityWeek](https://www.securityweek.com/citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products/) · [Horizon3 deep-dive + PoC (Oct 20)](https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/)