Core Privileged Access Manager Boks
Monthly
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the central BoKS Master when that client is selected for upgrade or patching. The flaw sits in the client version-handling logic of the legacy tar-based upgrade/patch tooling, turning a single rogue managed endpoint into a foothold on the security control plane. It is not in CISA KEV and no public exploit is identified at time of analysis; EPSS is low at 0.57% (43rd percentile), and CISA SSVC records exploitation as 'none' though technical impact as 'total'.
Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attackers to execute arbitrary OS commands with the privileges of the boks_autoregisterd service. The flaw resides in autoregistration processing and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, though no public exploit identified at time of analysis. Because BoKS is a privileged access management product, successful exploitation can directly undermine the security control plane intended to protect enterprise privileged accounts.
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the central BoKS Master when that client is selected for upgrade or patching. The flaw sits in the client version-handling logic of the legacy tar-based upgrade/patch tooling, turning a single rogue managed endpoint into a foothold on the security control plane. It is not in CISA KEV and no public exploit is identified at time of analysis; EPSS is low at 0.57% (43rd percentile), and CISA SSVC records exploitation as 'none' though technical impact as 'total'.
Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attackers to execute arbitrary OS commands with the privileges of the boks_autoregisterd service. The flaw resides in autoregistration processing and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, though no public exploit identified at time of analysis. Because BoKS is a privileged access management product, successful exploitation can directly undermine the security control plane intended to protect enterprise privileged accounts.