Security Hardening in FME 2026.2+ and Backport Versions

Introduction

FME workspaces have the potential to be very powerful, capable of broadly accessing system resources and executing scripts. While this power is important in some workflows, deployments where certain powerful capabilities are not required can benefit from hardening, reducing the attack surface, and lowering the potential for abuse, a cornerstone of security best practice.

Introduced in FME 2026.2 as part of ongoing security improvements across the FME platform, a variety of new security settings, grouped into different security tiers, give administrators greater control over what functionality can be executed in their environment. This applies whether you're managing an organization-wide FME deployment or have local admin rights on your own machine. If you've seen a log message about security tiers, or are configuring this setting for the first time, this article explains what security tiers are, how to choose one that matches your risk tolerance, and what to expect when you make a change.

Log Message

This message appears when a workspace attempts to use functionality that is restricted under your environment's current security tier. 

Security Tiers

Security tiers can only be changed by administrators. 

• Default Hardening: 
  • Default tier for new installations
  • Balanced security level allowing most operations
  • Some transformers and advanced scripting features (unlikely to be used by most workspaces) are now disabled
  • This tier is strongly recommended for most users
• Minimal Hardening: 
  • Should only be used in isolated or testing environments
  • Basic security level allowing almost all capabilities, including advanced scripting features that have the potential to be abused by malicious actors
  • Implements an attack surface similar to that of FME deployments prior to FME 2026.2.
• Full Hardening (FME 2026.2.1+)
  • Maximum security
  • Restricts many sensitive operations within FME, including capabilities that remain available under Default Hardening
  • Use only where organizational security policy requires it. Default Hardening remains recommended for most users

Changing the Tier 

Security tiers can only be changed by an administrator and should be changed only on an as-needed basis. The Default Hardened tier is sufficient for almost all FME use cases. 

FME Form

To change the tier in FME Form, open FME Workbench as an Administrator. Navigate to Utilities > FME Options > Security, then select the desired tier. After clicking Apply, close all FME Form applications and reopen them. 

To open FME Workbench as admin on macOS/Linux:

macOS:
sudo "/Library/FME/2026.2/Apps/FME Workbench 2026.2.app/Contents/MacOS/FME Workbench 2026.2"

Linux:

sudo /opt/fme-form-2026.2/fmeworkbench

Note that FME is licensed per user, so an admin session of FME will require FME to be relicensed. 

FME Form CLI

To allow FME Admins to better automate/deploy the Security Hardening configuration for their machines, it is possible to set the tier from the command line:

fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "recommended"

Or

fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "minimal"

FME Flow

To change the tier in FME Flow, log in as an Administrator. Navigate to System Configurations > Security, expand Security Hardening, and select the desired tier. When changing to a lower security tier, a warning dialog will appear. After clicking Confirm in the warning dialog, click Save in the Security Hardening parameters to complete the change. 

Changing the security tier will trigger an asynchronous restart of all engines. Each engine restarts only after completing any current jobs, then re-registers with FME Flow so the updated security policy can be applied during the registration handshake. Because the restart is asynchronous, confirmation that the tier has changed will be provided before all engines have successfully restarted and received the update.

Advanced: Custom Security Override 

A JSON snippet can be used to relax any selected security tier to allow specific actions. The JSON override snippet adjusts specific parts of the selected tier’s built-in defaults and re-enables capabilities that the selected tier is designed to block.

To learn about scenarios where applying an override may be considered, see: Known Issues and Considerations: Behavior Changes After November 2026 FME Security Updates.

Override Best Practices

• Relax from the highest security tier that works: Because an override can re-enable blocked capabilities, start with Default Hardening and loosen it using well-formed JSON snippets to the minimum necessary, rather than dropping to a lower tier.
• Use the smallest valid snippet: Allowing only those specific capabilities needed to run key workflows enables you to maximize the security benefits offered by the selected tier.
• Use only valid JSON: If the applied JSON snippet is malformed or invalid, an error may be thrown, and FME Form may fail to open. For more information about this error, see: Known Issue: FME Form 2026.2 and backported versions fail to open after an invalid JSON security override is applied. 
• Contact Support for assistance: For hands-on assistance with applying overrides or to request a custom JSON snippet for a specific scenario not covered in Known Issues and Considerations: Behavior Changes After November 2026 FME Security Updates, please contact Support.

Applying an Override

FME 2026.2+

• FME Form:
  • Open FME Workbench with administrator privileges.
  • Go to Utilities > FME Options > Security pane.
  • Enable Advanced - Custom Security Override to expand and paste the supplied JSON into the Configuration JSON box. Leave the tier as appropriate (e.g. Recommended).
  • Click OK / Apply. FME Workbench and other FME Form applications such as FME Data Inspector must be restarted for the override to take effect. Restart FME Workbench and go to  Utilities > FME Options > Security and expand the Advanced - Custom Security group to confirm the override JSON is stored.

• FME Flow:
  • Log in as an Administrator. Navigate to System Configurations > Security, expand Security Hardening.
  • Enable ‘Advanced - Custom Security Override’ to expand and paste the supplied JSON into the Configuration JSON box. Click Save.
  • Configuration is stored in the FME Flow database and delivered to Engines centrally — there is no need to place a file on each engine machine.
  • The setting is not applied to Engines connected to FME Flow until the FME Engine restarts — a forced restart may be necessary to re-run the workspace and verify the override was applied successfully.

FME 2026.1 and older backport versions

• FME Form:
  • Where a build still reads overrides directly, the override is delivered as that file in FME_HOME/res/engineconfig_patch.json
  • There is no user interface available with patched versions so security overrides must be applied as a user with administrator privileges to a configuration file located at FME_HOME/res/engineconfig_patch.json 
  • It is highly recommended to create a backup of the configuration file before applying changes, as a malformed or invalid JSON configuration file may cause FME Form to not open.
  • Merge the JSON override into the engineconfig_patch.json file. The override values are case-sensitive. It is recommended to validate the JSON after making any changes to ensure there are no syntax errors. If you require assistance, please contact Support.
  • After replacing the configuration file, FME needs to be restarted if it is already open.
• FME Flow:
  • There is no user interface available with patched versions, so security overrides must be applied as a user with administrator privileges to a configuration file located at FME_ENGINE/res/engineconfig_patch.json 
  • Merge the JSON override into the engineconfig_patch.json file. The override values are case-sensitive. It is recommended to validate the JSON after making any changes to ensure there are no syntax errors. If you require assistance, please contact Support.
  • For distributed FME Flow installations, an individual engineconfig_patch.json file for each Engine registered with the FME Flow core must be updated and each Engine restarted manually.
  • This only applies to backported versions. 

Support 

If you have any questions or need to request a JSON snippet, please contact Support.