Fortra FIM Stored XSS in Asset View UI

Publication date: 2026-06-23

Last updated on: 2026-06-28

Assigner: Fortra

Description

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-06-28

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-12163

EUVD

EUVD-2026-38631

Affected Vendors & Products

Vendor	Product	Version / Range
fortra	file_integrity_monitoring	to 9.4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue found in Fortra File Integrity Monitoring (FIM), formerly known as Tripwire Enterprise, in versions prior to 9.4.0.1. It exists in the Asset View UI component. An authenticated user with sufficient privileges to create or modify certain node or database configuration fields can insert malicious script content. This script content may then be rendered as executable HTML when the affected Asset View UI is displayed, instead of being safely escaped as plain text.

Impact Analysis

The impact of this vulnerability includes the potential for an attacker with appropriate privileges to execute malicious scripts within the context of the affected application. This can lead to unauthorized actions such as data manipulation or theft, session hijacking, or other malicious activities that compromise the integrity and confidentiality of the system. The CVSS score of 5.5 indicates a moderate severity with potential impacts on confidentiality and integrity.

Hi! I’m here to help you understand CVE-2026-12163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70