CVE-2026-12164

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.fortra.com/security/advisories/product-security/fi-2026-010	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortra:file_integrity_monitoring:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Fortra File Integrity Monitoring (FIM), anteriormente Tripwire Enterprise, versiones anteriores a la 9.4.0 puede asignar permisos efectivos incorrectos o elevados a usuarios creados por el comando tetool import mientras FIM está en ejecución, particularmente cuando la importación también crea o cambia roles o relaciones rol-permiso.

Information

Published : 2026-06-23 23:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12164

Mitre link : CVE-2026-12164

CVE.ORG link : CVE-2026-12164

JSON object : View

Products Affected

fortra

file_integrity_monitoring

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-12164", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12164", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T13:15:29.228755Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "affectedData": [{"vendor": "Fortra", "product": "File Integrity Monitoring (FIM)", "versions": [{"status": "affected", "version": "0", "lessThan": "9.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-23T23:16:49.297", "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-010", "tags": ["Vendor Advisory"], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the\u00a0tetool import\u00a0command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships."}, {"lang": "es", "value": "Fortra File Integrity Monitoring (FIM), anteriormente Tripwire Enterprise, versiones anteriores a la 9.4.0 puede asignar permisos efectivos incorrectos o elevados a usuarios creados por el comando tetool import mientras FIM est\u00e1 en ejecuci\u00f3n, particularmente cuando la importaci\u00f3n tambi\u00e9n crea o cambia roles o relaciones rol-permiso."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortra:file_integrity_monitoring:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A6BB06-2705-44CA-87D3-277FE156431E", "versionEndExcluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}