by Kastro
Paper/Archive/CVE-2026-9862

CVE-2026-9862

Fortra Core Privileged Access Manager (BoKS) — Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.6.626 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

Affected

ProductAffectedFixed inSource
Core Privileged Access Manager (BoKS)boks-server 8.1.0.0 – boks-server 8.1.0.22–CNA
Core Privileged Access Manager (BoKS)boks-server 9.0.0.0 – boks-server 9.0.0.4–CNA

Scores by source

Fortra (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryfortra.com/security/advisories/product-security/fi-2026-007