Key points
- The vulnerability is classified as a path traversal issue within the grpc phQueryMaster service.
- FortiGuard PSIRT assigned a CVSSv3 score of 9.4 to this unauthenticated remote code execution flaw.
- No patch or mitigation update has been confirmed in the provided source material.
FortiSIEM contains a high-severity security flaw that permits unauthenticated attackers to execute unauthorized code. FortiGuard PSIRT published an advisory for this path traversal vulnerability on October 13, 2026. The issue resides in the grpc phQueryMaster component of the security information and event management platform.
In plain English
Path traversal attacks occur when a system fails to properly restrict file access to specific directories. In this case, an attacker sends specially crafted packets to the affected service. These inputs trick the application into reading or writing files outside the intended location. This behavior can lead to the execution of arbitrary commands on the host system without any prior authentication.
The background
Fortinet’s security research team identified the improper limitation of pathname handling in their FortiSIEM product. The advisory describes the flaw under CWE-22, which covers improper restrictions on pathname traversal. The CVSSv3 base score of 9.4 reflects the high impact and ease of exploitation. This rating indicates that the vulnerability is severe and requires immediate attention from operators.
What changes now
Security teams must now account for a newly disclosed remote code execution vector in their FortiSIEM environments. Because the flaw allows unauthenticated access, it poses a significant risk to systems exposed to untrusted networks. Organizations should verify the status of their instances against the vendor’s guidance. The advisory was revised on October 13, 2026, confirming the severity and nature of the defect.
Who needs to act first
Teams should prioritize assessing external-facing FortiSIEM instances for immediate exposure. Verify network segmentation controls to ensure the vulnerable service is not accessible from untrusted zones. If an update becomes available, test it in a non-production environment first. Back up configuration files before applying any changes. Monitor logs for unusual file access patterns or unexpected command executions while awaiting a permanent fix from the vendor.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe: FortiSIEM
- Review firewall rules to restrict access to the grpc phQueryMaster service to trusted management networks only.
- Enable detailed logging on FortiSIEM servers to detect unauthorized file access attempts or anomalous traffic patterns.
- Isolate vulnerable instances from production environments if they cannot be patched immediately.
- Monitor vendor communications for the release of a security update or interim mitigation guidance.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a CVE ID assigned to this FortiSIEM vulnerability?
The provided source material does not include a specific CVE identifier for this flaw.
What is the CVSS score for this path traversal issue?
FortiGuard PSIRT assigned a CVSSv3 score of 9.4 to this vulnerability.
Does FortiSIEM have a patch available for this flaw?
No patch or fix has been confirmed in the current source material.
