Loading story…
Fortra released security updates for Core Privileged Access Manager (BoKS) to fix two command injection vulnerabilities that could allow attackers to execute commands and, in some cases, gain elevated privileges on affected systems. The most severe flaw, CVE-2026-9862, carries a CVSS 9.8 rating and can be exploited over the network with low attack complexity, requiring no privileges and no user interaction.
A second vulnerability, CVE-2026-9863 with CVSS 7.5, affects upgrade tooling and could be used to compromise a legacy tar-installed client and run commands on the target system, though exploitation requires user interaction and high attack complexity. The advisory urges organizations using BoKS to apply the vendor patch as soon as testing is complete to reduce the risk of remote compromise and privilege escalation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On June 16, 2026, Fortra released a security update to remediate two vulnerabilities in Core Privileged Access Manager (BoKS): CVE-2026-9862 and CVE-2026-9863. The advisory said the flaws could enable elevated privileges or command execution on affected systems and urged enterprises to deploy the patch after testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra disclosed **CVE-2026-9862**, a critical OS command injection flaw in **Core Privileged Access Manager (BoKS)** that allows an unauthenticated remote attacker to execute arbitrary commands through the `boks_autoregisterd` autoregistration service. The vulnerability, tracked in advisory **FI-2026-007**, affects the BoKS autoregistration functionality exposed on **TCP port 6507** by default and was classified as **CWE-78** with a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Successful exploitation could lead to full system compromise, including data manipulation, service disruption, lateral movement, privilege escalation, and malware deployment, because commands run with the service's privileges. While patches were not yet available at disclosure, Fortra advised organizations to immediately restrict network access to the vulnerable service or disable autoregistration by changing the `boksinit` configuration on the BoKS Master system.
Jun 29, 2026
Fortra BoKS Manager (`boks-server`) contains two vulnerabilities: a heap overflow in KSL checksum initialization and a stack buffer overflow in the Core Privileged Access Manager (BoKS) autoregistration functionality. The flaws affect BoKS Manager versions earlier than `8.1.0.24` and `9.0.0.7`. The Canadian Centre for Cyber Security issued advisory AV26-987 urging organizations using affected releases to review Fortra's security advisories and apply the available updates. Security teams should identify exposed or internally deployed BoKS Manager instances, upgrade to the fixed release for their version branch, and validate remediation across privileged-access infrastructure.
Oct 1, 2026
Fortinet disclosed two high-severity vulnerabilities affecting **FortiSandbox** and **FortiDDoS-F**, both of which could allow unauthorized code or command execution. **CVE-2026-39808** is an OS command injection flaw in FortiSandbox versions `4.4.0` through `4.4.8`, mapped to `CWE-78`, with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remote exploitation without authentication and high impact across confidentiality, integrity, and availability. Fortinet also disclosed **CVE-2026-39815**, an SQL injection vulnerability in FortiDDoS-F versions `7.2.1` through `7.2.2`, mapped to `CWE-89`. The flaw requires low privileges but may likewise enable unauthorized code or command execution, and carries a `CVSS 3.1` vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. The issues are tracked in Fortinet advisories **FG-IR-26-100** and **FG-IR-26-119**, respectively, expanding the vendor's latest set of appliance security fixes.
Jun 29, 2026