Loading story…
Fortra disclosed CVE-2026-9862, a critical OS command injection flaw in Core Privileged Access Manager (BoKS) that allows an unauthenticated remote attacker to execute arbitrary commands through the boks_autoregisterd autoregistration service. The vulnerability, tracked in advisory FI-2026-007, affects the BoKS autoregistration functionality exposed on TCP port 6507 by default and was classified as CWE-78 with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Successful exploitation could lead to full system compromise, including data manipulation, service disruption, lateral movement, privilege escalation, and malware deployment, because commands run with the service's privileges. While patches were not yet available at disclosure, Fortra advised organizations to immediately restrict network access to the vulnerable service or disable autoregistration by changing the boksinit configuration on the BoKS Master system.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-9862 was recorded on 2026-06-15 for Fortra Core Privileged Access Manager (BoKS). The entry classifies the issue as CWE-78 and assigns a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Fortra publicly disclosed CVE-2026-9862 on 2026-06-15 via advisory FI-2026-007. The flaw allows unauthenticated remote OS command injection in the BoKS autoregistration service, and Fortra recommended restricting network access or disabling autoregistration until patches are available.
Fortra advisory FI-2026-007 states the OS command injection flaw in Core Privileged Access Manager (BoKS) was identified on 2026-05-27. The vulnerability affects the boks_autoregisterd service and can be reached remotely over TCP port 6507 by default.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourcefortra.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra released security updates for **Core Privileged Access Manager (BoKS)** to fix two command injection vulnerabilities that could allow attackers to execute commands and, in some cases, gain elevated privileges on affected systems. The most severe flaw, **`CVE-2026-9862`**, carries a **CVSS 9.8** rating and can be exploited **over the network** with **low attack complexity**, requiring **no privileges** and **no user interaction**. A second vulnerability, **`CVE-2026-9863`** with **CVSS 7.5**, affects upgrade tooling and could be used to compromise a **legacy tar-installed client** and run commands on the target system, though exploitation requires **user interaction** and **high attack complexity**. The advisory urges organizations using BoKS to apply the vendor patch as soon as testing is complete to reduce the risk of remote compromise and privilege escalation.
Jul 8, 2026
Fortra BoKS Manager (`boks-server`) contains two vulnerabilities: a heap overflow in KSL checksum initialization and a stack buffer overflow in the Core Privileged Access Manager (BoKS) autoregistration functionality. The flaws affect BoKS Manager versions earlier than `8.1.0.24` and `9.0.0.7`. The Canadian Centre for Cyber Security issued advisory AV26-987 urging organizations using affected releases to review Fortra's security advisories and apply the available updates. Security teams should identify exposed or internally deployed BoKS Manager instances, upgrade to the fixed release for their version branch, and validate remediation across privileged-access infrastructure.
Oct 1, 2026
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026