FortiSIEM and port 27918: what an open port does and does not tell you

FortiSIEM CVE-2026-106173 is reachable through a gRPC service on TCP port 27918 using a path traversal that makes no authentication demand. The exposure question that follows is whether that port answers on the internet, and the measurement question is whether ZoomEye can be used to find out.

ZoomEye queries for this article could not be completed: the API returned HTTP 502 throughout the research window. The query designs below are reproducible and carry no result counts, because reporting a count that was never retrieved would be fabrication.

Port queries are the strongest and weakest evidence at once

port=27918 is unambiguous about one thing: something answered a TCP handshake on that number. ZoomEye associates services with ports and protocols, and a bare port query does not require the service to have been identified as FortiSIEM.

That property cuts both ways.…