EUVD-2026-38636
GHSA-3x8g-cjc2-45qp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
PR:H reflects mandatory admin-level tetool access; I:H captures unauthorized permission elevation; C:N and A:N because no data exposure or service disruption occurs.
Primary rating from Vendor (Fortra).
CVSS VectorVendor: Fortra
Lifecycle Timeline
3DescriptionCVE.org
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
AnalysisAI
Incorrect privilege assignment in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0 causes the tetool import command to assign elevated or incorrect effective permissions to newly created users when FIM is actively running during import. The flaw is compounded when the import operation also creates or modifies roles or role-permission relationships, meaning users may silently receive access levels beyond what was configured. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high-privilege prerequisite that limits realistic exposure to administrative misuse or insider threat scenarios.
Technical ContextAI
The affected component is the tetool command-line utility bundled with Fortra File Integrity Monitoring (formerly Tripwire Enterprise), used by administrators to bulk-import users, roles, and permission configurations. CWE-266 (Incorrect Privilege Assignment) is the root cause class, indicating that during the import process the software fails to correctly resolve or apply the intended effective permissions - particularly when role membership and role-permission relationships are created or modified in the same operation while the FIM service is running. This suggests a race condition or transaction-ordering defect in how FIM reconciles the imported permission graph against its live runtime state. Affected product is confirmed by CPE cpe:2.3:a:fortra:file_integrity_monitoring_(fim):*:*:*:*:*:*:*:* covering all versions prior to 9.4.0. The product was previously marketed as Tripwire Enterprise, meaning installations carrying either brand name may be affected if below the fix version.
RemediationAI
Upgrade Fortra FIM to version 9.4.0 or later per the vendor advisory at https://www.fortra.com/security/advisories/product-security/fi-2026-010. As a compensating control on unpatched systems, stop the FIM service before executing any tetool import operation that creates or modifies users, roles, or role-permission relationships, then restart the service after the import completes - this eliminates the concurrent-execution condition that triggers the flaw, though it requires a maintenance window and brief monitoring gap. Additionally, after any import operation performed on an unpatched system while FIM was running, administrators should audit the effective permissions of all newly created or modified user accounts and compare them against the intended role definitions to identify and manually correct any incorrectly elevated assignments. Restricting tetool execution to a specific privileged service account and logging all import operations will improve detectability of unintended privilege changes.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today