CVE-2026-9862

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

State: Published
Severity: 9.8 Critical
Published: Jun 15, 2026
Updated: Jun 15, 2026
Reserved: May 28, 2026

Description

Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Fortra

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Core Privileged Access Manager (BoKS)Fortra	boks-server 8.1.0.0 through boks-server 8.1.0.22Affected boks-server 9.0.0.0 through boks-server 9.0.0.4Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2026-007vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.