A critical OS command injection vulnerability has been disclosed in Fortra’s Core Privileged Access Manager (BoKS), a widely used privileged access management solution.
Tracked as CVE-2026-9862 and assigned a CVSS v3.1 score of 9.8, the flaw could allow unauthenticated remote attackers to execute arbitrary commands on affected systems, a worst-case scenario for any enterprise security tool.
The vulnerability, identified under Fortra’s internal advisory FI-2026-007, resides in the boks_autoregisterd service the daemon responsible for handling automatic client registration within the BoKS ecosystem.
Critical Fortra Access Manager Flaw
The flaw is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection‘), a class of bugs that arise when user-controlled input is passed unsanitized to a system shell or command interpreter.
According to the advisory published on June 15, 2026, a remote attacker with network-level access to the vulnerable service can craft malicious input during the autoregistration process, triggering commands to execute with the privileges of the boks_autoregisterd service.
Because no prior authentication is required, this vulnerability carries the maximum attack vector rating: network-accessible, low complexity, no privileges needed, no user interaction required (AV:N/AC:L/PR:N/UI:N), Fortra said.
The flaw was first discovered on May 27, 2026, giving organizations roughly three weeks of exposure before public disclosure.
Core Privileged Access Manager (BoKS) sits at the heart of enterprise identity and access control. It governs who can access what across critical Unix and Linux infrastructure.
A successful exploit against this tool doesn’t just compromise a single host it potentially hands an attacker the keys to an organization’s entire privileged access architecture.
Remote code execution on a PAM platform is among the most severe outcomes in enterprise security, as it can directly facilitate lateral movement, credential theft, and full domain compromise.
Affected Products and Mitigation
Fortra has confirmed that both boks-server 8.1 and 9.0 are affected. While fixed builds are expected, two immediate workarounds are available:
- Restrict network access to the boks_autoregisterd service, which listens on port 6507 by default, using firewall rules or network segmentation.
- Disable the service entirely by editing
$BOKS_var/internal/boksinit/masteron the BoKS Master node and commenting out the autoregisterd line with a#prefix, then reloading boks_init usingkill -HUP $(cat $BOKS_var/run/boks_init)or restarting BoKS entirely. Note that this disables autoregistration functionality until the configuration is restored.
Security teams are strongly advised to apply these mitigations immediately, prioritize patch deployment once fixed builds are available, and review network exposure of port 6507 across all environments.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
, a widely used privileged access management solution.){kind=link}