On Oct 23 the Canadian Centre for Cyber Security updated advisory AV26-1037 to say that open-source reporting indicates CVE-2026-106173 is being exploited in the wild. The bug is the critical (CVSS 9.4) path traversal in FortiSIEM's phQueryMaster gRPC service on TCP 27918, which lets an unauthenticated attacker write files and run code. Horizon3 published a root-cause write-up and a working proof of concept on Oct 20.

• What isn't confirmed: the Cyber Centre doesn't name the reporting it relies on, and as of this update Fortinet's FG-IR-26-180 still shows Known Exploited: No. CISA hasn't added it to KEV, and no victims or attacker indicators have been published.
• Affected: FortiSIEM 7.5.0 (fixed in 7.5.1). The CVE record also lists 7.0 through 7.4. FortiSIEM 7.6 and FortiSIEM Cloud aren't affected.
• Do now: upgrade to 7.5.1 or later, or block TCP 27918 from anything that isn't another FortiSIEM node (Fortinet says restricting the port prevents the issue). Horizon3 notes that application logs don't show the attack, so check file timestamps on cron-run scripts such as /opt/charting/redishb.sh (see the FortiSIEM hunt).

A SIEM sees everything your defenders see, and a public PoC makes this easy to use. Treat any internet-reachable FortiSIEM node as possibly compromised until checked.