CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in…
- Risk score
- 82/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Exploitation reported in the press
In the news
TL;DR
Critical path traversal flaw in Fortinet FortiSIEM 7.5.0 allows unauthenticated attackers to execute unauthorized code or commands.
- Cybersecurity researchers have released a proof-of-concept exploit for the vulnerability.
- SecurityWeek reports that the vulnerability is being actively exploited in the wild.
- The Hacker News notes that the vulnerability is a critical path traversal flaw with a CVSS score of 9.4.
- Fortinet has patched the vulnerability, but users are advised to apply the patch as soon as possible.
AI summary of 1 article.
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: fortinet
References
Original description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
Last activity 13 Oct 2026. Patch Forecast updates every hour.