A critical flaw in Fortinet's FortiSIEM security monitoring product can let an attacker run commands on the server without logging in. A public proof-of-concept exploit is available and Canadian authorities report it is now being used in real attacks.

• What it is: an unauthenticated remote code execution flaw (CVE-2026-106173, severity 9.4 out of 10) in FortiSIEM version 7.5.0.
• Who is affected: organisations running FortiSIEM 7.5.0. Version 7.6 is reported as not affected.
• The risk: a compromised monitoring server can expose logs, stored credentials and a path into the rest of the network.
• What to do: upgrade to FortiSIEM 7.5.1 or later straight away, and make sure the management interface is not reachable from the internet.

If your business uses FortiSIEM, we recommend patching today and checking the system for unexpected activity. Contact OzComm if you would like us to confirm your version. Source: The Hacker News.