Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-9862

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fortra

Description

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortra Core Privileged Access Manager (BoKS)

Default version status: unaffected

  • boks-server 8.1.0.0 to ≤ boks-server 8.1.0.22affected
  • boks-server 9.0.0.0 to ≤ boks-server 9.0.0.4affected

References