FortiSIEM CVE-2026-106173: what port 27918 exposure does and doesn't prove

CVE-2026-106173 in FortiSIEM 7.5.0 (CVSS 9.8) is reachable via an unauthenticated gRPC service on TCP port 27918 through path traversal. The analysis explains what port-based ZoomEye queries can and cannot establish; the queries themselves failed with HTTP 502 during the research window.

• CVE-2026-106173 affects only FortiSIEM 7.5.0; 7.5.1 fixes it and 7.6 is unaffected
• Exploitation goes through unauthenticated gRPC on TCP 27918, CVSS 9.8
• A bare port=27918 query can't tell FortiSIEM from a load balancer or honeypot
• Tighter query: port = 27918 && app = "FortiSIEM" or product = "Fortinet"