Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortra | Core Privileged Access Manager (BoKS) | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to boks-server 8.1.0.23 or 9.0.0.5.
Vendor Workaround
Restrict network access to boks_autoregisterd, which listens on port 6507 by default, until fixed builds are deployed. Another workaround for both boks-server 8.1 and 9.0 is to disable the service in the boksinit configuration. On the BoKS Master, edit $BOKS_var/internal/boksinit/master and comment out the line `autoregisterd:300:1:0:respawn::$BOKS_lib/boks_autoregisterd -xn` by prefixing it with `#`; then make boks_init reread the file, for example by running `kill -HUP $(cat $BOKS_var/run/boks_init)`, or restart BoKS. This stops boks_autoregisterd and prevents it from being respawned; autoregistration is unavailable until the row is restored.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 15 Jun 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 15 Jun 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing. | |
| Title | Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Fortra
Published:
Updated: 2026-06-15T16:09:28.297Z
Reserved: 2026-05-28T16:37:50.792Z
Link: CVE-2026-9862
Vulnrichment
Updated: 2026-06-15T16:09:23.776Z
NVD
Status : Awaiting Analysis
Published: 2026-06-15T16:16:35.357
Modified: 2026-06-15T21:01:58.873
Link: CVE-2026-9862
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')