Vulnerability · Published Jun 23, 2026 · Assigned by Fortra
CVE-2026-12164Privilege Escalation in Fortra File Integrity Monitoring (FIM)
Medium 4.4
In plain English
A medium-severity security flaw in File Integrity Monitoring (FIM) from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | File Integrity Monitoring (FIM) | 0 – before 9.4.0 |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N