Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
Summary
| CVE | CVE-2026-9862 |
|---|---|
| State | PUBLISHED |
| Assigner | Fortra |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-15 16:16:35 UTC |
| Updated | 2026-06-15 16:16:35 UTC |
| Description | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from df4dee71-de3a-4139-9588-11b62fe6c0ff
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-78 | CWE-78 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | df4dee71-de3a-4139-9588-11b62fe6c0ff | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Fortra | Core Privileged Access Manager BoKS | affected boks-server 8.1.0.0 boks-server 8.1.0.22 custom | Not specified |
| CNA | Fortra | Core Privileged Access Manager BoKS | affected boks-server 9.0.0.0 boks-server 9.0.0.4 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.fortra.com/security/advisories/product-security/fi-2026-007 | df4dee71-de3a-4139-9588-11b62fe6c0ff | www.fortra.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Fortra internal security assessment (en)
Additional Advisory Data
Solutions
CNA: Upgrade to boks-server 8.1.0.23 or 9.0.0.5.
Workarounds
CNA: Restrict network access to boks_autoregisterd, which listens on port 6507 by default, until fixed builds are deployed. Another workaround for both boks-server 8.1 and 9.0 is to disable the service in the boksinit configuration. On the BoKS Master, edit $BOKS_var/internal/boksinit/master and comment out the line `autoregisterd:300:1:0:respawn::$BOKS_lib/boks_autoregisterd -xn` by prefixing it with `#`; then make boks_init reread the file, for example by running `kill -HUP $(cat $BOKS_var/run/boks_init)`, or restart BoKS. This stops boks_autoregisterd and prevents it from being respawned; autoregistration is unavailable until the row is restored.