Fortra BoKS CVE-2026-12627

Requires network access to the BoKS autoregistration service (boks_autoregisterd) and the ability to participate in or spoof the client autoregistration handshake so that an attacker-controlled 'client response' is parsed by the daemon. Per CVSS PR:N/UI:N no authentication or user interaction is needed, but exploitation is practically limited to networks where this enrollment service is reachable - typically the internal management/agent network rather than the public internet - and reliable code execution (versus a daemon crash/DoS) depends on defeating standard stack-overflow mitigations. No special product configuration is cited beyond the autoregistration service being enabled and listening.

This is a genuine high-priority issue on the signals available. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity memory corruption in boks_autoregisterd, and the description aligns cleanly with that vector - the autoregistration service is network-reachable and processes attacker-influenced 'client response' data, so there is no AV/PR contradiction to flag. CWE-121 (stack-based buffer overflow) is a classic code-execution primitive, and because this daemon is part of a BoKS Master/replica enrollment path it typically runs with high privilege, making the C:H/I:H/A:H rating credible rather than inflated. However, no EPSS probability, no CISA KEV listing, and no public POC are present in the input, so there is currently no evidence of active or automated exploitation - the 9.8 reflects potential impact, not observed in-the-wild activity. Real-world exploitability is tempered by two unknowns the vendor advisory does not resolve: whether modern stack protections (canaries/ASLR/NX) reduce this to a DoS rather than reliable RCE, and how exposed the autoregistration service typically is (it is usually reachable only within the managed enterprise/agent network, not the open internet). Net: treat as a serious patch-now item for BoKS operators, but note this is high-CVSS-with-unproven-exploitation rather than confirmed mass exploitation.

An attacker with network reach to a BoKS host's autoregistration service connects as (or impersonates) an enrolling client and returns a malformed response during the autoregistration handshake, overflowing a fixed-size stack buffer in boks_autoregisterd. Successful exploitation corrupts memory to crash the daemon (DoS) or, if protections are bypassed, execute code in the privileged BoKS enrollment process. No public exploit is identified at time of analysis, and reliable code execution from a stack overflow would require defeating standard memory protections.