CVE-2026-106173

CriticalCVSS 9.8

Published: 13/10/2026(UTC)Updated: 21/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Risk Assessment

An attacker could access files outside the restricted directory and execute code, potentially leading to system compromise or data breach.

Recommendation

Update FortiSIEM to a version that fixes this vulnerability and restrict network access to the service.

Other vulnerabilities in Fortinet FortiSIEM

CVE-2025-64155Critical
Fortinet FortiSIEM versions 7.4.0, 7.3.0-7.3.4, 7.1.0-7.1.8, 7.0.0-7.0.4, and 6.7.0-6.7.10 contain an OS command injection vulnerability. An attacker can execute unauthorized code or commands via crafted TCP requests.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS