CVE-2026-12164— Privilege Escalation in Fortra File Integrity Monitoring (FIM)
Quick assessment
Affected
Fortra File Integrity Monitoring (FIM)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Fortra Fortra File Integrity Monitoring是Fortra公司的一款文件完整性监控软件。 Fortra File Integrity Monitoring 9.4.0之前版本存在权限许可和访问控制问题漏洞，该漏洞源于权限分配不当，可能导致用户权限提升。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Fortra | File Integrity Monitoring (FIM) | < 9.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12164
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privilege Escalation in Fortra File Integrity Monitoring (FIM)
Source: CVE Program / CVE List V5
Vulnerability Description
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Fortra File Integrity Monitoring 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fortra Fortra File Integrity Monitoring是Fortra公司的一款文件完整性监控软件。 Fortra File Integrity Monitoring 9.4.0之前版本存在权限许可和访问控制问题漏洞，该漏洞源于权限分配不当，可能导致用户权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Fortra | File Integrity Monitoring (FIM) | 0 ~ 9.4.0 | - |
|
II. Public POCs for CVE-2026-12164
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12164
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Fortra
-
CVE-2026-14316
Heap buffer overflow in boks_sshd revoked-key error handling -
CVE-2026-9864
Fortra BoKS Server Agent adjoin machine-account password gen -
CVE-2026-12627
Fortra's Core Privileged Access Manager (BoKS) autoregistrat -
CVE-2026-79896
Fortra BoKS Manager boks_portmux TLS ClientHello out-of-boun -
CVE-2026-79898
Fortra BoKS Manager crlserver command injection vulnerabilit
Same weakness: CWE-266
-
CVE-2026-102851
Visual Studio Code Security Feature Bypass Vulnerability -
CVE-2026-105445
Docker Hub account conversion could reassign an active perso -
CVE-2026-65199
Huawei openUBMC low-privilege SNMP to administrator privileg -
CVE-2026-59241
SIMATIC WinCC越权漏洞（CVE-2024-12345） -
CVE-2026-104661
Incorrect Privilege Assignment in GitLab
V. Comments for CVE-2026-12164
No comments yet