Security Hardening in FME 2026.2

Introduction

FME workspaces have the potential to be very powerful, capable of broadly accessing system resources and script execution. While this power is important in some workflows, deployments where certain powerful capabilities are not required can benefit from hardening, reducing the attack surface, and lowering the potential for abuse, a cornerstone of security best practice.

Introduced in FME 2026.2 as part of ongoing security improvements across the FME platform, a variety of new security settings, grouped into different security tiers, give administrators greater control over what functionality can be executed in their environment. This applies whether you're managing an organization-wide FME deployment or have local admin rights on your own machine. If you've seen a log message about security tiers, or are configuring this setting for the first time, this article explains what security tiers are, how to choose one that matches your risk tolerance, and what to expect when you make a change.

Log Message

Error: …This workspace may require a capability not permitted by your current security settings. See https://fme.ly/ybu for more information

Or

…failed to evaluate expression

This message appears when a workspace attempts to use functionality that is restricted under your environment's current security tier. 

If you are an administrator, review your current security tier selection and consider whether an adjustment or a custom override is appropriate.
If you are a user, contact your administrator to determine whether the required capability can be enabled in your environment.

Security Tiers

Security tiers can only be changed by administrators. 

• Default Hardening: 
  • Default tier for new installations
  • Balanced security level allowing most operations
  • Some advanced scripting features (unlikely to be used by the vast majority of workspaces) are now disabled/reduced
  • This tier is strongly recommended for most users
• Minimal Hardening: 
  • Should only be used in isolated or testing environments
  • Basic security level allowing almost all capabilities, including advanced scripting features that have the potential to be abused by malicious actors
  • Implements an attack surface similar to that of FME deployments prior to FME 2026.2.
• Full Hardening (FME 2026.2.1+)
  • Maximum security
  • Restricts many sensitive operations within FME, including capabilities that remain available under Default Hardening
  • Use only where organizational security policy requires it. Default Hardening remains recommended for most users

The restrictions amongst the tiers are subject to change between releases. As best practice, always use the Default Hardening level whenever possible.

Changing the Tier 

Security tiers can only be changed by an administrator and should be changed only on an as-needed basis. The Default Hardened tier is sufficient for almost all FME use cases. 

FME Form

To change the tier in FME Form, open FME Workbench as an Administrator. Navigate to Utilities > FME Options > Security, then select the desired tier. After clicking Apply, close all FME Form applications and reopen them. 

To open FME Workbench as admin on macOS/Linux:

macOS:
sudo "/Library/FME/2026.2/Apps/FME Workbench 2026.2.app/Contents/MacOS/FME Workbench 2026.2"

Linux:

sudo /opt/fme-form-2026.2/fmeworkbench

Note that FME is licensed per user, so an admin session of FME will require FME to be relicensed. 

FME Form CLI

To allow FME Admins to better automate/deploy the Security Hardening configuration for their machines, it is possible to set the tier from the command line:

fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "recommended"

Or

fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "minimal"

FME Flow

To change the tier in FME Flow, log in as an Administrator. Navigate to System Configurations > Security, expand Security Hardening, and select the desired tier. When changing to a lower security tier, a warning dialog will appear. After clicking Confirm in the warning dialog, click Save in the Security Hardening parameters to complete the change. 

Changing the security tier will trigger an asynchronous restart of all engines. Each engine restarts only after completing any current jobs, then re-registers with FME Flow so the updated security policy can be applied during the registration handshake. Because the restart is asynchronous, confirmation that the tier has changed will be provided before all engines have successfully restarted and received the update.

Advanced - Custom Security Override 

A JSON snippet can be used to relax the applied security tier to allow specific actions. The JSON override snippet adjusts specific parts of the selected tier’s built-in defaults and re-enables capabilities that the selected tier is designed to block. Please contact Support for a snippet customized for your specific scenario. 

Support 

If you have any questions or need to request a JSON snippet, please contact Support.