Critical FortiSIEM 7.5.0 flaw gets public exploit

FortiSIEM 7.5.0 contains an unauthenticated path traversal in the phQueryMaster gRPC service on port 27918 that lets an attacker overwrite /opt/charting/redishb.sh, which cron runs every 60 seconds with elevated privileges. The flaw, CVE-2026-106173, is rated CVSS 9.8 and is fixed in 7.5.1; 7.6 and FortiSIEM Cloud are unaffected.

• CVE-2026-106173: CVSS 9.8 path traversal in the phQueryMaster gRPC service
• A NUL byte in the query identifier bypasses the filename write constraint
• Exploit overwrites redishb.sh, executed by cron every 60 seconds
• Fixed in FortiSIEM 7.5.1; 7.6 and Cloud are not affected