Fortra FIM CVE-2026-12164

Exploitation requires all three of the following conditions to be simultaneously true: (1) an administrator executes the tetool import command while the Fortra FIM service is actively running - the defect does not trigger if the service is stopped during import; (2) the import file creates or modifies roles or role-permission relationships in addition to creating users - imports that only create users without touching role or permission mappings may not be affected; and (3) the attacker or beneficiary is the user account created by that import, meaning the elevated privilege must then be leveraged by a separate actor or the same admin account acting beyond its intended scope. High-privilege access (PR:H per CVSS) to the FIM administrative environment is required to initiate the import in the first place. There is no confidentiality or availability impact - exploitation is limited to unauthorized integrity write access within the FIM system itself.

The CVSS 3.1 base score of 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N is internally consistent: exploitation requires high-privilege access (PR:H) to execute the tetool import, which meaningfully constrains the attacker population to FIM administrators. The integrity-only impact (I:H, C:N, A:N) reflects that the consequence is unauthorized write capability to FIM policy and user configuration, not data theft or service disruption. No EPSS score was provided in the source data, and the absence of a CISA KEV entry and public POC further supports treating this as a low-urgency, medium-severity issue. The primary real-world risk is privilege creep through routine administrative operations - an admin performing a legitimate import inadvertently grants a user more access than intended, which could then allow that user to tamper with integrity baselines or monitoring policies. This is particularly concerning given that FIM is itself a compensating control in many compliance frameworks; undermining its access model defeats its security purpose. The AV:N vector warrants a note: tetool is a CLI utility and its network accessibility depends on whether administrators run it via remote shell sessions or from the FIM server itself - this should be verified against the deployment model.

An FIM administrator performs a routine bulk user provisioning task by running tetool import while the FIM service is actively running, including a configuration file that defines new users alongside updated roles and role-permission mappings. Due to the privilege assignment defect, one or more imported users receive effective permissions beyond their intended role - for example, gaining write access to integrity monitoring policies or the ability to approve baseline changes. Those users can then silently tamper with FIM baselines or suppress alerts, undermining the integrity monitoring controls that the platform is designed to enforce.