FortiSIEM CVE-2026-106173 (FG-IR-26-180) unauthenticated RCE now exploited in the wild with public PoC: which version fixes it and how do I mitigate?

What it is: a critical path traversal flaw in FortiSIEM's phQueryMaster gRPC service. An unauthenticated attacker who can reach the service can write files and run code on the FortiSIEM supervisor or workers. Fortinet fixed it in its October 13, 2026 release (advisory FG-IR-26-180). Horizon3.ai then published technical details and a public proof of concept, and on October 23, 2026 Canada's Cyber Centre updated its advisory to say it is being exploited in the wild. Am I affected? On-premises FortiSIEM before 7.5.1. Version 7.5.0 is confirmed affected and some reports list 7.0 to 7.4 as well; check FG-IR-26-180 for your branch. FortiSIEM 7.6 and FortiSIEM Cloud are reported as not affected. How to check: in the FortiSIEM GUI (or with phshowVersion.sh on the supervisor) confirm the version on the supervisor, workers and collectors. Fix: upgrade to FortiSIEM 7.5.1 or later (or to 7.6). Upgrade every node in the cluster. Interim mitigation (if you can't upgrade right away): block access to TCP port 27918 (the phQueryMaster service) from everything except the FortiSIEM nodes that need it. Fortinet says restricting this port prevents the issue. FortiSIEM should never be reachable from the internet. After patching, check for compromise: the attack leaves few application log entries, so look at the file system instead. Look for recently modified or new files in FortiSIEM install folders and in scheduled scripts or cron jobs, new users or SSH keys, and unexpected outbound connections from the appliances. If anything looks wrong, rebuild the node and rotate credentials FortiSIEM stores (device discovery accounts, API keys, LDAP bind accounts), since a SIEM holds credentials for much of the network. Sources: https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037 https://securityonline.info/fortisiem-cve-2026-106173-exploited-poc/ https://www.hkcert.org/security-bulletin/fortinet-products-multiple-vulnerabilities_20261014