October 25, 2026
- FortiSIEM CVE-2026-106173 PoC from Horizon3 targets the gRPC
QueryResultReqhandler on TCP/7900 — improper validation of attacker-controlled metadata gives path traversal and arbitrary file write, chained to RCE by overwriting files the system later executes. CVSS 9.4, unauthenticated, affecting FortiSIEM 7.0.0 through 7.5.0 across multiple branches; fixed in 7.5.1 and 7.6.0. (Horizon3) · New Tools & Releases
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox