CVE-2026-12163

Stored XSS in Fortra File Integrity Monitoring (FIM)

State: Published
Severity: 5.5 Medium
Published: Jun 23, 2026
Updated: Jun 24, 2026
Reserved: Jun 12, 2026

Description

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	Fortra

Weaknesses

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Affected Products

Product	Versions
File Integrity Monitoring (FIM)Fortra	before 9.4.0.1Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2026-009

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.