EUVD-2026-36731
GHSA-cvv9-gwh6-485x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise legacy tar-installed BoKS client
-
DeliveryPlant malicious client version string
-
ExploitMaster selected to upgrade/patch client
-
ExecutionInjection triggered in version handling
-
PersistExecute arbitrary commands on BoKS Master
-
ImpactFull compromise of PAM control plane
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a legacy tar-installed BoKS client that is malicious or already compromised and enrolled in the BoKS domain, and (2) that specific client being selected for an upgrade or patch operation, whose version handling on the BoKS Master is where injection occurs (UI:R - a Master-side operator must initiate the upgrade/patch). It does NOT apply to deployments that do not use legacy tar-based client installations or that never run the tar-based upgrade/patch tooling. Limiting factors: the attacker must first control a domain client (a non-trivial precondition despite the PR:N rating), the vulnerable path is confined to legacy tar-based tooling, and only boks-server versions 9.0.0.0-9.0.0.4 and 8.1.0.0-8.1.0.22 are in scope. |
| Impact | Signals are moderately consistent but point to a targeted rather than mass-exploited threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, 8.8 High) reflects total compromise of the Master, but the exploitation path is gated by two real preconditions the score partly obscures: the attacker must already control a legacy tar-installed client, and a Master-side operator must select that client for upgrade or patching (UI:R). CISA SSVC reinforces this - Exploitation: none, Automatable: no, Technical Impact: total - indicating high damage potential but no self-propagating, opportunistic exploitation. EPSS of 0.57% and absence from KEV align with SSVC's 'none/no' assessment. The PR:N rating is technically defensible (no credentials on the Master are needed) but understates that a trust relationship or prior client compromise is a practical prerequisite; treat this as a high-impact, lower-likelihood issue that is a priority specifically for organizations running legacy tar-based BoKS clients. |
| Exploit ScenarioDerived | An attacker who has compromised a legacy tar-installed BoKS client crafts a malicious version identifier so that when a BoKS administrator later selects that client for a routine upgrade or patch, the Master parses the attacker-controlled version data and executes injected OS commands with the Master's privileges. Because the Master is the PAM control plane, this yields high-impact code execution on the most sensitive host in the environment. No public exploit is identified at time of analysis, and success depends on the administrator triggering the upgrade/patch action (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the central BoKS Master when that client is selected for upgrade or patching. The flaw sits in the client version-handling logic of the legacy tar-based upgrade/patch tooling, turning a single rogue managed endpoint into a foothold on the security control plane. It is not in CISA KEV and no public exploit is identified at time of analysis; EPSS is low at 0.57% (43rd percentile), and CISA SSVC records exploitation as 'none' though technical impact as 'total'.
Earlier versions of this analysis (2)
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the BoKS Master when an operator selects that client for upgrade or patching. Affected releases are boks-server 8.1.0.0-8.1.0.22 and 9.0.0.0-9.0.0.4, and successful exploitation yields total confidentiality, integrity, and availability impact on the central policy Master. There is no public exploit identified at time of analysis, EPSS risk is modest (0.57%, 43rd percentile), and CISA SSVC records no known exploitation.
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) allows a malicious or compromised legacy tar-installed client to execute arbitrary commands on the BoKS Master server during the client upgrade or patch workflow. The flaw resides in the client version-handling logic of the legacy tar-based client upgrade/patch tooling and carries a CVSS 3.1 score of 7.5 (High) with full CIA impact. Currently no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
RemediationAI
Consult and apply the fixes in Fortra advisory FI-2026-008 (https://www.fortra.com/security/advisories/product-security/fi-2026-008); the affected ranges end at boks-server 9.0.0.4 and 8.1.0.22, so upgrade to the next Fortra-released fixed build above those on the respective branch - Patch available per vendor advisory, but an exact fixed version number is not stated in the provided data, so confirm the target release directly from FI-2026-008. As a compensating control until patched, avoid initiating upgrade or patch operations on legacy tar-installed clients from the Master, and migrate legacy tar-based clients to the supported package-based client format to remove the vulnerable code path entirely (trade-off: migration requires per-host effort and change windows). Additionally, tighten trust in enrolled clients - audit and remove unknown or unmanaged tar-installed clients and restrict which operators can trigger client upgrades - recognizing this reduces but does not eliminate exposure if a trusted client is compromised.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BoKS Manager is Fortra's centralized privileged access management (PAM) and access-control platform built around a BoKS Master server that governs a domain of enrolled client hosts. This vulnerability is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-influenced data (a client's reported version string during the tar-based upgrade/patch workflow) is passed into a shell context on the Master without adequate sanitization. Only the legacy tar-based client installation and upgrade/patch tooling is implicated - modern package-based client handling is not referenced. The single CPE, cpe:2.3:a:fortra:core_privileged_access_manager_(boks), confirms the affected component is the BoKS/Core PAM server-side tooling.
Know when Core Privileged Access Manager Boks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Injection reaches the Master over the network with no Master credentials (PR:N) but needs an operator-initiated upgrade (UI:R); total compromise of the Master gives C:H/I:H/A:H, same host so S:U.
Primary rating from Vendor (Fortra).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
Executive ViewAI
CVE-2026-9863 in Fortra BoKS Manager (Privileged Access Manager) allows attackers with control of a single legacy tar-installed endpoint to execute arbitrary commands on the central BoKS Master-the security control plane protecting all organizational credentials. This creates a critical supply-chain risk: a compromised managed endpoint becomes a direct pivot point to the PAM system itself, potentially exposing every privileged credential the organization protects. Leadership must immediately identify and isolate legacy tar-based client installations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Isolate or decommission legacy tar-installed clients where operationally feasible; (2) Implement firewall/network segmentation to restrict legacy client access to BoKS Master; (3) Disable automated client upgrade/patching and require human review before any maintenance; (4) Enable detailed audit logging of all BoKS Master interactions and client communications to detect unauthorized command execution; (5) Deploy host-based controls on legacy clients to block suspicious process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attac
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memor
Exploit-DB