CVE-2026-9862: Fortra Core Privileged Access Manager (BoKS) OS command injection in autoregistration service
Fortra has disclosed an OS command injection flaw (CWE-78) in the boks_autoregisterd service of Core Privileged Access Manager (BoKS). The record reports a CVSS base score of 9.8 and describes network exploitation without authentication, with commands running under the service's privileges. The sources consulted show no confirmed exploitation, and the record lists no fixed version, so administrators should consult the vendor advisory and check whether their builds fall within the affected ranges.
Overview
Fortra has published a vendor advisory describing an OS command injection vulnerability in the boks_autoregisterd service of Core Privileged Access Manager (BoKS). The weakness is classified as CWE-78. According to the record, the flaw is reachable over the network and may let a remote party cause commands to run with the privileges of the service during autoregistration processing.
Impact
The record reports a CVSS base score of 9.8 (critical). The vector indicates network access, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. If exploited, the consequences would depend on the privileges of the affected service, which the record does not detail.
Affected products and versions
- Fortra Core Privileged Access Manager (BoKS), boks-server from 8.1.0.0 up to and including 8.1.0.22.
- Fortra Core Privileged Access Manager (BoKS), boks-server from 9.0.0.0 up to and including 9.0.0.4.
- Fortra Core Privileged Access Manager Server, from 8.1.0.0 before 8.1.0.23.
- Fortra Core Privileged Access Manager Server, from 9.0.0.0 before 9.0.0.5.
The record contains no fixed-version field. The upper bounds of the ranges suggest that 8.1.0.23 and 9.0.0.5 are the first builds outside the affected ranges, but this is an inference that should be confirmed in the vendor advisory.
Exploitation status
The CISA KEV catalog flag in the record is false. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The record gives an EPSS probability of 0.01481 and an SSVC exploitation value of none. Public exploit code availability is unknown from the available data.
Remediation and mitigation
- Review the Fortra advisory FI-2026-007 and identify the installed boks-server and Core Privileged Access Manager Server versions.
- Plan upgrades to the builds the vendor specifies as corrected. Based on the ranges, builds at or beyond 8.1.0.23 and 9.0.0.5 appear to be outside the affected set, pending vendor confirmation.
- Until patching is complete, restrict network access to the autoregistration service to trusted hosts and limit exposure from untrusted networks.
- Apply the principle of least privilege to the service account and review segmentation of privileged access infrastructure.
Detection guidance
- Monitor network connections to the autoregistration service from unexpected sources.
- Review service and host logs for unusual child processes or unexpected command activity originating from the autoregisterd service.
- Track authentication and registration events for anomalies around the time of exposure.
Limitations of the available information
The record does not provide a fixed version, a detailed technical description of the injection point, proof-of-concept status, or vendor-confirmed exploitation information. The CVSS score is taken from the record. Statements about fixed builds are inferences from the affected ranges and must be verified against the vendor advisory.
Frequently asked questions
Is this CVE being actively exploited?
The record shows the CISA KEV flag as false, and no confirmed exploitation appears in the sources consulted. Monitoring should continue because the vulnerability is rated critical.
Which versions are affected?
According to the record, boks-server from 8.1.0.0 up to and including 8.1.0.22 and from 9.0.0.0 up to and including 9.0.0.4 are affected, along with Core Privileged Access Manager Server builds before 8.1.0.23 and before 9.0.0.5 in their respective branches.
Is a fixed version available?
The record does not list a fixed version. The upper bounds of the affected ranges suggest corrected builds, but this must be confirmed in the Fortra advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.