CVE-2026-9862: Fortra BoKS PAM RCE Vulnerability

CVE-2026-9862 Overview

CVE-2026-9862 is an operating system command injection vulnerability [CWE-78] in Fortra's Core Privileged Access Manager (BoKS). The flaw resides in the boks_autoregisterd service, which handles client autoregistration requests over the network. A remote, unauthenticated attacker with network access to the service can inject operating system commands that execute with the privileges of the service. Because BoKS is a privileged access management product, the affected service typically runs with elevated rights on a master server. Successful exploitation gives an attacker direct command execution on the host that brokers privileged access across an enterprise.

Critical Impact
An unauthenticated network attacker can execute arbitrary OS commands on the BoKS master, compromising the privileged access broker for the entire managed environment.

Affected Products

Fortra Core Privileged Access Manager (BoKS)
boks_autoregisterd service component
Refer to the Fortra advisory for specific fixed versions

Discovery Timeline

2026-06-15 - CVE-2026-9862 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database
2026-06-18 - EPSS score recorded at 0.845% (percentile 53.17)

Technical Details for CVE-2026-9862

Vulnerability Analysis

The vulnerability is an OS command injection in the boks_autoregisterd daemon. Autoregistration is the process by which BoKS clients announce themselves to a master server and receive configuration. The daemon accepts network input during this handshake and incorporates attacker-controllable values into a command that is passed to an operating system shell. Because the inputs are not properly neutralized, shell metacharacters break out of the intended command context. The injected commands execute with the privileges of the boks_autoregisterd service, which in standard deployments runs with elevated rights on the BoKS master. An attacker therefore gains direct execution on the system that controls privileged access policies across all managed hosts.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Input received during autoregistration processing is concatenated into a shell command without sanitization or use of parameterized execution primitives. This permits metacharacters such as ;, |, `, and $() to alter the intended command syntax.

Attack Vector

The attack vector is the network. The CVSS vector indicates no authentication and no user interaction are required. An attacker only needs reachability to the boks_autoregisterd listening port on a BoKS master server. The exploit consists of sending a crafted autoregistration request containing shell metacharacters in fields that the daemon passes to the OS shell. No verified public proof-of-concept code is currently available. See the Fortra Security Advisory FI-2026-007 for vendor technical details.

Detection Methods for CVE-2026-9862

Indicators of Compromise

Unexpected child processes spawned by the boks_autoregisterd service, such as sh, bash, wget, curl, nc, or python.
Outbound network connections initiated by the BoKS master process tree to unfamiliar destinations.
New or modified files in BoKS configuration directories or system paths shortly after autoregistration traffic.
Autoregistration log entries containing shell metacharacters (;, |, `, $() in hostname or client identifier fields.

Detection Strategies

Monitor process lineage on BoKS master servers and alert when boks_autoregisterd forks shells or interpreters.
Inspect network logs for autoregistration requests from hosts outside the expected managed inventory.
Correlate authentication and privilege escalation events on the master with inbound traffic to the autoregistration port.

Monitoring Recommendations

Enable verbose logging on the boks_autoregisterd service and forward logs to a central SIEM.
Baseline expected autoregistration sources and alert on requests from new or unauthorized network segments.
Track integrity of BoKS binaries and configuration files with file integrity monitoring.

How to Mitigate CVE-2026-9862

Immediate Actions Required

Apply the fixed BoKS release identified in Fortra Security Advisory FI-2026-007 as soon as possible.
Restrict network access to the boks_autoregisterd port using host and network firewalls, allowing only trusted client subnets.
Audit recent autoregistration activity and BoKS master process history for signs of exploitation.

Patch Information

Fortra has published Fortra Security Advisory FI-2026-007 with remediation guidance for Core Privileged Access Manager (BoKS). Administrators should consult the advisory for fixed version numbers and upgrade procedures for their specific deployment.

Workarounds

Disable the boks_autoregisterd service on masters where autoregistration is not required and provision clients manually.
Place BoKS masters behind a jump host or management VLAN that is unreachable from general user networks.
Enforce strict allowlisting at the network layer so only known client IP addresses can reach the autoregistration port until patching is complete.

bash

# Example: restrict access to the boks_autoregisterd port with iptables
# Replace <PORT> with the autoregistration port and <CLIENT_SUBNET> with trusted ranges
iptables -A INPUT -p tcp --dport <PORT> -s <CLIENT_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp --dport <PORT> -j DROP