CVE-2026-12163
Received Received - Intake
Fortra FIM Stored XSS in Asset View UI

Publication date: 2026-06-23

Last updated on: 2026-06-23

Assigner: Fortra

Description
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-23
Last Modified
2026-06-23
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-12163
EUVD
EUVD-2026-38631
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
fortra file_integrity_monitoring to 9.4.0.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue found in Fortra File Integrity Monitoring (FIM), formerly known as Tripwire Enterprise, in versions prior to 9.4.0.1. It exists in the Asset View UI component. An authenticated user with sufficient privileges to create or modify certain node or database configuration fields can insert malicious script content. This script content may then be rendered as executable HTML when the affected Asset View UI is displayed, instead of being safely escaped as plain text.

Impact Analysis

The impact of this vulnerability includes the potential for an attacker with appropriate privileges to execute malicious scripts within the context of the affected application. This can lead to unauthorized actions such as data manipulation or theft, session hijacking, or other malicious activities that compromise the integrity and confidentiality of the system. The CVSS score of 5.5 indicates a moderate severity with potential impacts on confidentiality and integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart