CVE-2026-9862Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
- 9.8CriticalCVSS base score
- 0.99%Exploitation in 30 daysEPSS · top 37% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Timeline
ID reserved
By Fortra
- 18 days later
· 18 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| FortraCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.99% · top 37% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
Fortra · Core Privileged Access Manager (BoKS)
- affected boks-server 8.1.0.0 – ≤ boks-server 8.1.0.22
- affected boks-server 9.0.0.0 – ≤ boks-server 9.0.0.4
What to do
Solution: Upgrade to boks-server 8.1.0.23 or 9.0.0.5.
Workaround: Restrict network access to boks_autoregisterd, which listens on port 6507 by default, until fixed builds are deployed. Another workaround for both boks-server 8.1 and 9.0 is to disable the service in the boksinit configuration. On the BoKS Master, edit $BOKS_var/internal/boksinit/master and comment out the line `autoregisterd:300:1:0:respawn::$BOKS_lib/boks_autoregisterd -xn` by prefixing it with `#`; then make boks_init reread the file, for example by running `kill -HUP $(cat $BOKS_var/run/boks_init)`, or restart BoKS. This stops boks_autoregisterd and prevents it from being respawned; autoregistration is unavailable until the row is restored.
References
References1
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-36730 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-9862)Record last updated .