Loading story…
Fortra BoKS Manager (boks-server) contains two vulnerabilities: a heap overflow in KSL checksum initialization and a stack buffer overflow in the Core Privileged Access Manager (BoKS) autoregistration functionality. The flaws affect BoKS Manager versions earlier than 8.1.0.24 and 9.0.0.7.
The Canadian Centre for Cyber Security issued advisory AV26-987 urging organizations using affected releases to review Fortra's security advisories and apply the available updates. Security teams should identify exposed or internally deployed BoKS Manager instances, upgrade to the fixed release for their version branch, and validate remediation across privileged-access infrastructure.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-987 for vulnerabilities affecting Fortra BoKS Manager (boks-server), including a heap overflow in KSL checksum initialization and an autoregistration stack buffer overflow. The advisory identified versions before 8.1.0.24 and 9.0.0.7 as affected and urged users to apply available updates.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra released security updates for **Core Privileged Access Manager (BoKS)** to fix two command injection vulnerabilities that could allow attackers to execute commands and, in some cases, gain elevated privileges on affected systems. The most severe flaw, **`CVE-2026-9862`**, carries a **CVSS 9.8** rating and can be exploited **over the network** with **low attack complexity**, requiring **no privileges** and **no user interaction**. A second vulnerability, **`CVE-2026-9863`** with **CVSS 7.5**, affects upgrade tooling and could be used to compromise a **legacy tar-installed client** and run commands on the target system, though exploitation requires **user interaction** and **high attack complexity**. The advisory urges organizations using BoKS to apply the vendor patch as soon as testing is complete to reduce the risk of remote compromise and privilege escalation.
Jul 8, 2026
Fortra disclosed **CVE-2026-9862**, a critical OS command injection flaw in **Core Privileged Access Manager (BoKS)** that allows an unauthenticated remote attacker to execute arbitrary commands through the `boks_autoregisterd` autoregistration service. The vulnerability, tracked in advisory **FI-2026-007**, affects the BoKS autoregistration functionality exposed on **TCP port 6507** by default and was classified as **CWE-78** with a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Successful exploitation could lead to full system compromise, including data manipulation, service disruption, lateral movement, privilege escalation, and malware deployment, because commands run with the service's privileges. While patches were not yet available at disclosure, Fortra advised organizations to immediately restrict network access to the vulnerable service or disable autoregistration by changing the `boksinit` configuration on the BoKS Master system.
Jun 29, 2026
Fortinet issued multiple 2026 security advisories covering a broad set of vulnerabilities across **FortiSandbox, FortiManager, FortiAnalyzer, FortiOS, FortiAP, FortiProxy, FortiPAM, FortiSwitchManager, FortiSwitchAXFixed,** and related cloud offerings. The most severe flaws affect **FortiSandbox**, including `CVE-2026-39808`, an unauthenticated OS command injection bug that could allow arbitrary command execution and full device compromise, `CVE-2026-39813`, a path traversal issue in the JRPC API that may enable authentication bypass and privilege escalation, and `CVE-2026-26083`, a missing authorization flaw that can expose restricted functionality and sensitive sandbox analysis data through the GUI without authentication. National cyber authorities in Canada and Belgium separately warned organizations to apply Fortinet’s fixes immediately. Fortinet also disclosed high-risk issues in management platforms, notably `CVE-2025-54820`, a stack-based buffer overflow in the **FortiManager** `fgtupdates` service that can let remote unauthenticated attackers execute unauthorized commands when the service is enabled, as well as a heap-based buffer overflow affecting **FortiAnalyzer Cloud** and **FortiManager Cloud**. Additional weaknesses across the product line include authentication and MFA bypasses, SQL injection, API denial of service, CLI command injection in FortiAP, CAPWAP daemon memory corruption in FortiOS, stored and reflected XSS, improper access control, and credential exposure. Fortinet advised customers to upgrade to fixed releases, disable exposed services such as `fgtupdates` where possible, restrict CLI, SSH, and API access, and monitor logs for anomalous authentication, privilege escalation, and endpoint activity.
Jun 29, 2026