What is the CVSS score of CVE-2026-9862?

CVE-2026-9862 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Fortra BoKS are affected by CVE-2026-9862?

Fortra's Core Privileged Access Manager (BoKS) contains a critical remote unauthenticated command injection vulnerability (CVE-2026-9862, CVSS 9.8) that allows attackers to execute arbitrary commands…

How to fix or mitigate CVE-2026-9862?

Within 24 hours: Conduct inventory of all BoKS installations (versions, network location, connected systems) and determine exposure scope. Within 7 days: Implement emergency network isolation-restrict BoKS autoregistration interface to trusted administrative networks only and deny all inbound connectivity from untrusted sources; enable full request logging and monitor logs for exploitation attempts. Within 30 days: Contact Fortra for patch timeline and critical advisory details; if patch timeline exceeds 60 days, initiate emergency procurement and deployment of alternative PAM solution or implement parallel out-of-band privileged account access pathway.

Fortra BoKS CVE-2026-9862

EUVD-2026-36730 CRITICAL

OS Command Injection (CWE-78)

2026-06-15 Fortra

GHSA-32v6-8gq7-4gxm

Command Injection Core Privileged Access Manager Boks

9.8

CVSS 3.1 · Vendor: Fortra

Severity by source

Vendor (Fortra) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states remote network attacker against a listening autoregistration service with no authentication, and command execution as the service account yields full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Fortra).

CVSS VectorVendor: Fortra

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 16:31 vuln.today

DescriptionCVE.org

Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

AnalysisAI

Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attackers to execute arbitrary OS commands with the privileges of the boks_autoregisterd service. The flaw resides in autoregistration processing and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, though no public exploit identified at time of analysis. Because BoKS is a privileged access management product, successful exploitation can directly undermine the security control plane intended to protect enterprise privileged accounts.

Technical ContextAI

BoKS is Fortra's centralized privileged access management platform for managing administrative access across heterogeneous Unix, Linux, and Windows estates. The vulnerable component, boks_autoregisterd, is the daemon responsible for handling automatic registration of new hosts/agents into the BoKS domain, a network-facing service by design. The root cause class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-controlled input received during the autoregistration handshake is passed to a shell or system call without adequate sanitization, allowing shell metacharacters to break out of the intended command context. The CPE cpe:2.3:a:fortra:core_privileged_access_manager_(boks):*:*:*:*:*:*:*:* indicates affected versions are not version-bounded in NVD data, implying broad applicability across BoKS releases pending vendor advisory clarification.

RemediationAI

Patch availability and exact fixed version must be confirmed against Fortra advisory FI-2026-007 at https://www.fortra.com/security/advisories/product-security/fi-2026-007 - apply the vendor-supplied update to all BoKS master and replica servers as the primary remediation. Until the patched build is deployed, compensating controls include restricting network access to the boks_autoregisterd service via host firewall or network ACLs so only known management subnets and registering hosts can reach it (trade-off: blocks legitimate autoregistration from new networks and may require manual host enrollment), and where operationally feasible, temporarily disabling the autoregistration daemon and enrolling new hosts via the manual registration workflow (trade-off: significant operational overhead in dynamic environments). Monitor boks_autoregisterd logs for malformed registration requests and unexpected child processes spawned by the service account as a detection layer.