CVE-2026-9862
CRITICAL
INFO
Priority: 0.10
BB Relevance:
80/100
Published: 2026-06-15
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| fortra | core_privileged_access_manager_server | 8.1.0.0 – 8.1.0.23 |
| fortra | core_privileged_access_manager_server | 9.0.0.0 – 9.0.0.5 |
References & Advisories (1)
Vendor Advisory