Fortra BoKS Manager CVE-2026-79898

Requires an authenticated principal that is authorized to add CRL URLs in Fortra BoKS Manager (PR:H). Three delivery paths exist: the BCC administration console and the WSI REST or SOAP API are both network-accessible and require NO local sudo or suexec rule, making them the realistic remote vectors; the cacrl command-line path additionally requires a sudo/suexec rule for non-root use. The injected command executes as root specifically within the crlserver process on the BoKS Master. Limiting factors: the attacker must already hold CRL-URL-add authorization (a delegated-admin capability, not a standard user right), and the target must be running the BoKS Master with crlserver active; no end-user interaction is needed (UI:N).

This is a genuine high-severity issue but with an important gating factor. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) is self-consistent and vendor-reported by Fortra: a network-reachable command-injection yielding root on the BoKS Master, with a scope change because the crlserver component executes the injected command as root. The single most important limiter is PR:H - exploitation requires an account already authorized to add CRL URLs, which is a privileged administrative function, so this is not an unauthenticated internet-facing bug. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation; the real-world risk is best read as 'high impact, low likelihood' driven by the privilege prerequisite and the product's niche footprint rather than mass-exploitability. The 9.1 is justified by impact (root compromise of the central policy server that governs access across an enterprise), not by ease of reaching the vulnerable function. Priority should be high for organizations that actually run BoKS as a privileged-access gatekeeper, because compromise of the Master is effectively compromise of the access-control plane; for everyone else the product is simply not deployed.

An administrator or delegated operator who holds authorization to register CRL distribution URLs - reachable remotely via the BCC console or the WSI REST/SOAP API without needing any local sudo/suexec rule - supplies a CRL URL containing shell command-substitution syntax. When crlserver processes that URL, the embedded command runs as root on the BoKS Master, giving the attacker full control of the central access-control server. No public proof-of-concept is identified at time of analysis.