CERT-In Flags Critical FortiSIEM Directory Traversal Flaw That Could Enable Remote Code Execution

India's Computer Emergency Response Team (CERT-In) has published a critical vulnerability note for Fortinet FortiSIEM, warning that a directory traversal flaw could allow an unauthenticated remote attacker to execute arbitrary code or commands on an affected system.

The advisory, CIVN-2026-0521, was originally issued on October 23, 2026. It identifies FortiSIEM versions earlier than 7.5.1 as affected and associates the vulnerability with CVE-2026-106173.

According to CERT-In, the vulnerability stems from improper restrictions on a pathname intended to remain within a designated directory. An attacker could attempt exploitation by sending specially crafted packets to a vulnerable system.

Successful exploitation could lead to remote code execution or command execution without authentication. CERT-In also warns of potential unauthorized access to sensitive information and disruption of services.

The agency advises affected organizations and system administrators to apply the appropriate security updates and mitigations recommended by Fortinet.

What Is the FortiSIEM Vulnerability?

FortiSIEM is Fortinet's security information and event management (SIEM) solution. It helps organizations collect, correlate, analyze, and monitor security events across their IT infrastructure.

A vulnerability in a SIEM platform is particularly relevant to security teams because the platform supports the monitoring and analysis of an organization's security events. However, CERT-In's notice does not report that the vulnerability has been exploited in the wild or confirm any resulting incidents.

The issue is classified as a directory traversal vulnerability. This class of flaw occurs when software does not properly restrict how a pathname is resolved, potentially allowing access beyond an intended directory.

In this case, CERT-In states that a remote attacker could send specially crafted packets to the affected FortiSIEM system. If exploitation succeeds, the attacker could execute arbitrary code or commands on the target.

CERT-In does not disclose further technical details about the vulnerable component, the specific packet structure, or the conditions required for successful exploitation.

Which FortiSIEM Versions Are Affected?

CERT-In lists the affected software as:

Administrators should check their deployed FortiSIEM version to determine whether their systems fall within the affected range.

CERT-In directs users to Fortinet's vendor advisory for the appropriate security updates and mitigations. The CERT-In notice identifies version 7.5.1 as the threshold in its affected-version description, but does not provide a detailed release-by-release remediation table.

Organizations should consult Fortinet's official advisory before selecting an upgrade path.

Vendor advisory: Fortinet PSIRT advisory FG-IR-26-180

CVE record: CVE-2026-106173

What Should FortiSIEM Administrators Do?

CERT-In recommends applying appropriate security updates and mitigations provided by the vendor. Organizations running FortiSIEM should prioritize determining whether their deployments use an affected version and consult Fortinet's advisory for remediation instructions.

Recommended actions grounded in the advisory include:

• Identify affected deployments: Check the versions of FortiSIEM instances in use.

• Consult the official vendor guidance: Review Fortinet's FG-IR-26-180 advisory for the applicable update and mitigation instructions.

• Apply the recommended remediation: Follow Fortinet's guidance for the affected deployment.

• Review remediation status: Verify that the installed version and applied updates align with the vendor's instructions.

The CERT-In notice does not provide a workaround, a detailed patch procedure, or specific detection indicators. Additional details were not disclosed in the announcement.

Conclusion

CERT-In's warning highlights a critical directory traversal vulnerability affecting Fortinet FortiSIEM versions earlier than 7.5.1. The flaw could allow an unauthenticated remote attacker to execute arbitrary code or commands if exploitation succeeds.

Organizations using FortiSIEM should check their deployed versions and follow Fortinet's official remediation guidance. Because the affected product supports security-event monitoring across IT environments, administrators should treat the advisory as a priority for vulnerability assessment and patch management.

CERT-In's notice does not confirm active exploitation, provide a CVSS score, or report incidents linked to this vulnerability. Organizations should use the official CERT-In and Fortinet advisories for verified updates.