CVE-2026-12163 is a stored cross-site scripting (XSS) vulnerability in Fortra File Integrity Monitoring (FIM), formerly known as Tripwire Enterprise. The issue exists in the Asset View UI component where input is not properly neutralized during web page generation. Authenticated users with privileges to create or modify specific node or database configuration fields can inject script content that is stored and later rendered as HTML instead of escaped text, potentially leading to script execution in the context of other users viewing the affected UI. The vulnerability affects versions prior to 9.4.0.1. No official patch or remediation level has been published by the vendor as of the data provided.

An attacker with authenticated access and sufficient privileges can inject malicious scripts that are stored and executed in the context of the web application UI. This could lead to limited confidentiality and integrity impacts, such as theft of session information or unauthorized actions within the application UI. There is no indication of availability impact. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should restrict privileges to trusted administrators only and monitor for suspicious activity related to configuration changes in the Asset View UI. Avoid exposing the affected UI to untrusted users. Follow vendor communications for updates on patches or official mitigations.