CVE-2026-9862

EUVD-2026-36730
Fortra's 
Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
fortracore_privileged_access_manager_server
8.1.0.0 ≤
𝑥
< 8.1.0.23
fortracore_privileged_access_manager_server
9.0.0.0 ≤
𝑥
< 9.0.0.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.fortra.com/security/advisories/product-security/fi-2026-007