CVE-2026-12163 is a stored cross-site scripting (XSS) vulnerability in Fortra File Integrity Monitoring (FIM), formerly known as Tripwire Enterprise. The issue exists in the Asset View UI component where input is not properly neutralized during web page generation. An authenticated user with high privileges can inject malicious script content into certain configuration fields. When this content is displayed in the Asset View UI, it may be executed as HTML/JavaScript instead of being safely escaped, potentially allowing code execution in the context of the victim's browser session.

The vulnerability allows an authenticated user with sufficient privileges to inject and store malicious script content that is executed in the context of other users viewing the Asset View UI. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed via the victim's browser. There is no direct impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with high privileges and carefully review inputs to the affected configuration fields. Monitor vendor communications for updates regarding an official fix.