---
title: Hunt: FortiSIEM CVE-2026-106173 now has a public PoC; look for outside connections to TCP 27918 (phQueryMaster gRPC), off-pattern changes to /opt/charting/redishb.sh and phLicenseTool, and stray files from '/query/result' traversal | ctxsec
url: https://ctxsec.com/items/hunt-fortisiem-cve-2026-106173-poc
description: ""
status: "hunt guidance (Horizon3 PoC + IOC notes, Oct 20). Update Oct 23: Canada's Cyber Centre says open-source reporting indicates exploitation; Fortinet still lists Known Exploited: No, last updated Oct 26, 2026, 12:05 PM ET"
published: 2026-10-20
updated: 2026-10-26T12:05:00-04:00
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-fortisiem-cve-2026-106173-poc.md)

hunt guidance (Horizon3 PoC + IOC notes, Oct 20). Update Oct 23: Canada's Cyber Centre says open-source reporting indicates exploitation; Fortinet still lists Known Exploited: No

2026-10-20 · updated

Oct 26, 2026, 12:05 PM ET

### Hunt: FortiSIEM CVE-2026-106173 now has a public PoC; look for outside connections to TCP 27918 (phQueryMaster gRPC), off-pattern changes to /opt/charting/redishb.sh and phLicenseTool, and stray files from '/query/result' traversal

**Update Oct 26:** Canada's Cyber Centre updated AV26-1037 on Oct 23 to say open-source reporting indicates this bug is being exploited in the wild (see [the news item](/items/fortisiem-cve-2026-106173-exploited-cyber-centre-warning)). Run this hunt now rather than waiting for KEV.

Context: [Fortinet FG-IR-26-180](/news#fortinet-oct-2026-fortisiem-fortisandbox) (CVSS 9.4, fixed in FortiSIEM 7.5.1, workaround: restrict TCP 27918). On Oct 20 Horizon3 published a root-cause write-up and a **public proof of concept**. The `phQueryMaster` gRPC service listens on `[::]:27918` with TLS but **doesn't request client certificates**, so anyone who can reach the port can call `SendQueryResult`. Its `query-id` metadata is concatenated into `/query/result/<id>` with no validation, which allows path traversal. A NUL byte in the value cuts off the server's `result-…dat` suffix, which gives an exact-path file overwrite. The PoC overwrites `/opt/charting/redishb.sh`, which cron runs every 60 seconds. Not in CISA KEV and no exploitation reported as of Oct 20, but public PoCs for Fortinet appliances have often been followed by mass scanning within days.

1. **Exposure:** list every FortiSIEM supervisor, worker and collector and confirm TCP 27918 is reachable only from FortiSIEM nodes. Pull firewall/NetFlow for any connection to 27918 from outside that set since Oct 13.
2. **File integrity:** on each node, compare mtime/ctime and hashes of `/opt/charting/redishb.sh` and `/opt/phoenix/bin/phLicenseTool` (the two files Horizon3 flags) against a clean install of the same version. Horizon3 found **no application log** that records exploitation, so timestamps and hashes are the main evidence.
3. **Traversal leftovers:** look for directories or `result-*-*-*-*.dat` files outside `/query/result/` (for example under `/tmp`), and for recently changed scripts run by cron (`crontab -l` for admin/root, `/etc/cron*`).
4. **Post-exploitation:** new outbound connections from FortiSIEM nodes, new SSH keys or users, and unexpected child processes of cron or the `admin` user.

If anything turns up, treat the SIEM as compromised: its stored credentials (collector, AD and cloud integrations) need rotating, and its logs can't be trusted to clear itself.

Sources: [Horizon3: CVE-2026-106173 deep-dive + PoC (Oct 20)](https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/) · [FortiGuard FG-IR-26-180](https://fortiguard.fortinet.com/psirt/FG-IR-26-180) · [Canadian Centre for Cyber Security: Fortinet security advisory AV26-1037, Update 1 (Oct 23)](https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037)