CVE-2026-12164 describes a privilege assignment vulnerability in Fortra File Integrity Monitoring (FIM) versions before 9.4.0. When the tetool import command is executed during runtime, it may incorrectly assign elevated effective permissions to users, especially if the import modifies roles or role-permission mappings. This could lead to unauthorized privilege escalation within the system. The vulnerability has a CVSS 3.1 base score of 4.4, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date.

The vulnerability allows for incorrect or elevated permissions to be assigned to users created or modified by the tetool import command while FIM is running. This can result in unauthorized privilege escalation, potentially allowing users to perform actions beyond their intended permissions. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the tetool import command while FIM is active or ensure strict control over who can execute this command. Monitor for any unexpected privilege changes related to user roles and permissions during imports.