CVE-2026-9862
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Risk Assessment
The risk involves potential remote compromise of the system, allowing an attacker to execute arbitrary commands with service privileges, leading to data confidentiality, integrity, and availability breaches.
Recommendation
Apply the security update provided by Fortra immediately and restrict network access to the boks_autoregisterd service to trusted hosts only.
Original NVD description (English source)
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.