CVE-2026-9862 Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
Remote attackers can execute arbitrary OS commands with service privileges via the autoregistration service in Fortra Core Privileged Access Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9862?
CVE-2026-9862 is a critical command injection vulnerability in Fortra Core Privileged Access Manager (BoKS), published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Weakness: CWE-78
Which versions are affected by CVE-2026-9862?
It affects 1 product.
Products include Fortra Core Privileged Access Manager Server.
How do I fix CVE-2026-9862?
No fix has been published for CVE-2026-9862 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-9862 being exploited?
There is no known exploitation of CVE-2026-9862 in the wild and no public exploit code.
Other vulnerabilities in Fortra Core Privileged Access Manager (BoKS)
Sources
Also known as GHSA-32v6-8gq7-4gxm.