CVE-2026-9863 — Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

CVE-2026-9863

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability PUBLISHED

Description (CNA)

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

Affected (CNA)

Vendor / product	Versions
Fortra / Core Privileged Access Manager (BoKS)	affected boks-server 8.1.0.0 through boks-server 8.1.0.22; affected boks-server 9.0.0.0 through boks-server 9.0.0.4

CWE

CWE-78

References

https://www.fortra.com/security/advisories/product-security/fi-2026-008

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.