# CVE-2026-9862: Fortra Core Privileged Access Manager OS command injection in boks_autoregisterd

Source: https://junglewise.ai/threats/cve-2026-9862-fortra-core-privileged-access-manager-os-command-injection-in-boks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-9862 · Severity: critical · CVSS 9.8 · Published 2026-06-15

Fortra's Core Privileged Access Manager (BoKS) is a security solution used to manage and control administrative access to sensitive systems. A critical vulnerability has been identified that allows an unauthorized person to remotely execute commands on the system. This could lead to a complete takeover of the access management platform, potentially exposing all managed credentials and disrupting corporate security operations.

Vendors: [Fortra](https://junglewise.ai/threats/vendors/fortra).

## Quick answers

**Is CVE-2026-9862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9862 being exploited in the wild.

**How severe is CVE-2026-9862?** Critical severity, with a CVSS score of 9.8, published 15 June 2026.

**Which products and versions are affected?** Fortra Core Privileged Access Manager (BoKS).

**Is there a fix for CVE-2026-9862?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9862 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9862?** Check whether you run Fortra Core Privileged Access Manager (BoKS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists within the boks_autoregisterd service of Fortra Core Privileged Access Manager (BoKS). The flaw is triggered during the autoregistration process, where insufficient neutralization of special elements allows a remote, unauthenticated attacker to inject and execute arbitrary operating system commands. The attack is reachable over the network and requires no user interaction. Successful exploitation grants the attacker the ability to execute commands with the privileges of the affected service, potentially leading to full system compromise.

## Affected products

- Fortra Core Privileged Access Manager (BoKS)

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: advisory

## References

- [https://www.fortra.com/security/advisories/product-security/fi-2026-007](https://www.fortra.com/security/advisories/product-security/fi-2026-007)

## Related threats

- [Fortra Core Privileged Access Manager stack overflow in boks_autoregisterd](https://junglewise.ai/threats/cve-2026-12627-fortra-s-core-privileged-access-manager-boks-contains-a-stack)