Fortra® Security & Trust Center

Blog

Fortra Patch Priority Index for May 2026

By Lane Thames on Wed, 06/24/2026
Fortra’s May 2026 Patch Priority Index ranks the month’s most important vulnerabilities by real-world enterprise risk rather than severity score alone. It emphasizes prioritizing internet-facing and network-accessible systems first — especially Palo Alto GlobalProtect, Windows DNS, and Microsoft Exchange — while tracking cloud-side remediated issues separately when no customer patching is required.
Security Advisory

Privilege Escalation in Fortra File Integrity Monitoring (FIM)

Tue, 06/23/2026
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
FI-2026-010
Medium
CVE-2026-12164
Security Advisory

Stored XSS in Fortra File Integrity Monitoring (FIM)

Tue, 06/23/2026
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the...
FI-2026-009
Medium
CVE-2026-12163
Fortra Blog
Blog

Phishing Campaign Targets Banks with Fileless Phantom Stealer Malware

By Aranzazu Casillas on Tue, 06/16/2026
Executive SummaryFortra Intelligence and Research Experts (FIRE) have identified an active phishing campaign targeting high-capital organizations, particularly those operating within the banking sector. The campaign uses evasive techniques to distribute Phantom Stealer, a commercially available Malware-as-a-Service (MaaS) infostealer used to steal credentials, financial data, and sensitive...
Security Advisory

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

Mon, 06/15/2026
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
FI-2026-008
High
CVE-2026-9863
Emerging Threats

Oracle PeopleSoft PeopleTools Zero-day Vulnerability

Fri, 06/12/2026
Oracle has identified a critical zero-day vulnerability in PeopleSoft PeopleTools, tracked as CVE-2026-35273, with a CVSS base score of 9.8. This vulnerability allows unauthenticated remote code execution and is actively exploited by the ShinyHunters group in data theft attacks. CVERiskScoreCVE-2026-35273CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H9.8, CriticalExploitation of this vulnerability...