CVE-2026-9862
Fortra’s Core Privileged Access Manager (BoKS) has a critical OS command injection flaw in the boks_autoregisterd service. A remote attacker who can reach the service can run arbitrary commands with the service’s privileges, potentially taking full control of the system. The vulnerability is exploitable over the network and requires no user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
fortra core_privileged_access_manager_server
Real-world impact
An attacker could execute any operating‑system command with the privileges of the boks_autoregisterd service, allowing them to install malware, exfiltrate data, or pivot to other systems. This could lead to a complete compromise of the affected host and any resources it controls.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑accessible (AV:N), easy to exploit (AC:L), requires no attacker privileges (PR:N), and has no user interaction (UI:N). It grants full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making it a critical risk.
What to do about it
- ›Restrict network access to the boks_autoregisterd service so that only trusted hosts can reach it.
- ›Monitor logs for unexpected command execution or registration activity.
- ›Apply any future vendor patches as soon as they become available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 15, 2026 · Jun 15, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- fortra.com/security/advisories/product…vendor advisory