SB20260619104 - Remote code execution in Fortra Core Privileged Access Manager (BoKS)

Description

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2026-9862)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the boks_autoregisterd daemon when handling autoregistration events. A remote unauthenticated attacker can send specially crafted packets to port 6507 and execute arbitrary OS commands on the system with the privileges of the service during the autoregistration processing.

2) OS Command Injection (CVE-ID: CVE-2026-9863)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary commands on the BoKS Master.

The vulnerability exists due to command injection in the client upgrade and patch tooling when handling client version information from a legacy tar-installed client selected for upgrade or patching. A remote attacker can provide a malicious or compromised legacy tar-installed client to execute arbitrary commands on the BoKS Master.

User interaction is required to initiate the upgrade or patch operation.

Remediation

Install update from vendor's website.

References

• https://www.fortra.com/security/advisories/product-security/fi-2026-007
• https://www.fortra.com/security/advisories/product-security/fi-2026-008