Critical severity9.8NVD Advisory· Published Jun 15, 2026· Updated Jul 28, 2026
CVE-2026-9862
CVE-2026-9862
Description
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Affected products
3- cpe:2.3:a:fortra:core_privileged_access_manager_server:*:*:*:*:*:*:*:*Range: >=8.1.0.0,<8.1.0.23
Patches
Vulnerability mechanics
References
1- www.fortra.com/security/advisories/product-security/fi-2026-007nvdVendor Advisory
News mentions
2- ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreThe Hacker News · Jun 22, 2026
- Fortra Access Manager Vulnerability Enables Remote Command Injection AttacksCyber Security News · Jun 17, 2026