CVE-2026-12163: Stored XSS in Fortra File Integrity Monitoring (FIM)

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-79

Description

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.

Affected products

Fortra File Integrity Monitoring (FIM): before 9.4.0.1 — fixed in 9.4.0.1

How to fix

Upgrade to a fixed version: Fortra File Integrity Monitoring (FIM) 9.4.0.1. Check the vendor advisory for mitigations.

References

https://www.fortra.com/security/advisories/product-security/fi-2026-009

Get alerted when CVE-2026-12163 or the next vulnerability affects your stack