CVE-2026-9862CWE-78

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Critical · published June 15, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
73.7
In the wild
Unconfirmed
What it is

Fortra's

Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01481 · 73.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-15T15:10Z
EPSS history
Timeline
  • 15 JUN 15:10Z
    Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
    cvelistv5