CVE-2026-9862 — Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

CVE-2026-9862

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability PUBLISHED

Description (CNA)

Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

Affected (CNA)

Vendor / product	Versions
Fortra / Core Privileged Access Manager (BoKS)	affected boks-server 8.1.0.0 through boks-server 8.1.0.22; affected boks-server 9.0.0.0 through boks-server 9.0.0.4

CWE

CWE-78

References

https://www.fortra.com/security/advisories/product-security/fi-2026-007

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.