Fortra BoKS CVE-2026-9862

Exploitation requires network reachability to the boks_autoregisterd daemon on a BoKS master/replica during the autoregistration processing path - the attacker must be able to deliver a registration request the daemon will parse. No authentication, user interaction, or local access is required per CVSS PR:N/UI:N. Limiting factors: the daemon is typically only reachable on management/registration networks rather than the public internet, so internet-exposed BoKS installations are the primary realistic attack surface; deployments that have disabled autoregistration or firewalled the service to a known allowlist of enrolling hosts substantially reduce exposure. The exact wire format and which registration field carries the injection are not disclosed in the public description, so defenders cannot yet construct precise IDS signatures from CVE data alone.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H signals a worst-case profile: network reachable, low complexity, no authentication, no user interaction, with full CIA impact - consistent with a remote pre-auth RCE. EPSS and SSVC data were not provided in the input, so probabilistic exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV at time of analysis, so no public exploit identified at time of analysis. Despite the absence of exploitation telemetry, the target population (PAM infrastructure) is an unusually high-value asset: compromise yields lateral pivot into every system BoKS brokers access to, so defenders should treat this as a top-priority patch even without KEV/POC pressure. One limiting factor: exploitation requires network reachability to the boks_autoregisterd port, which in well-segmented deployments may be restricted to management networks - verify exposure before assuming internet-wide risk.

An attacker with network reachability to a BoKS master initiates a crafted autoregistration request to boks_autoregisterd containing shell metacharacters in a field that flows into an OS command (for example, hostname or identity payload), causing the daemon to execute attacker-chosen commands as the service account. The attacker then leverages the service's privileges on the BoKS master to read credential material, alter access policies, or plant a persistent backdoor across every system BoKS manages. No public exploit identified at time of analysis, but the CVSS AC:L/PR:N/UI:N profile means weaponization once details surface would be straightforward.