# CVE-2026-9863: Fortra BoKS Manager OS command injection in client upgrade tooling

Source: https://junglewise.ai/threats/cve-2026-9863-fortra-boks-manager-os-command-injection-in-client-upgrade-tooling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-9863 · Severity: high · CVSS 7.5 · Published 2026-06-15

Fortra BoKS Manager, a centralized security administration tool, contains a vulnerability in how it handles updates for older software installations. If an administrator attempts to upgrade or patch a compromised or malicious client machine, that machine can execute unauthorized commands on the central BoKS Master server. This could lead to a total compromise of the security management infrastructure, allowing an attacker to disrupt operations or gain unauthorized access to sensitive data.

Technologies: [Fortra BoKS Manager](https://junglewise.ai/threats/technologies/boks-manager). Vendors: [Fortra](https://junglewise.ai/threats/vendors/fortra).

## Quick answers

**Is CVE-2026-9863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9863 being exploited in the wild.

**How severe is CVE-2026-9863?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** Fortra BoKS Manager Legacy tar-based client installations.

**Is there a fix for CVE-2026-9863?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9863 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9863?** Check whether you run Fortra BoKS Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the Fortra BoKS Manager's client upgrade and patch tooling. The flaw is triggered during the version handling process for legacy tar-based client installations. An attacker who has compromised a legacy client can exploit this by waiting for an administrator to initiate an upgrade or patch cycle. When the BoKS Master interacts with the malicious client to process version information, it fails to properly neutralize special elements, allowing the client to inject and execute arbitrary commands on the Master server. This requires network reachability between the Master and the client and user interaction in the form of an administrator initiating the update process.

## Affected products

- Fortra BoKS Manager Legacy tar-based client installations

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: advisory

## References

- [https://www.fortra.com/security/advisories/product-security/fi-2026-008](https://www.fortra.com/security/advisories/product-security/fi-2026-008)

## Related threats

- [Fortra BoKS Manager out-of-bounds read in TLS parser](https://junglewise.ai/threats/cve-2026-79896-fortra-boks-manager-contains-an-out-of-bounds-read-vulnerability)
- [Fortra BoKS Manager insecure temporary file in bccgethostcert](https://junglewise.ai/threats/cve-2026-79899-fortra-boks-manager-contains-an-insecure-temporary-file)
- [Fortra BoKS Manager command injection in crlserver](https://junglewise.ai/threats/cve-2026-79898-fortra-boks-manager-contains-a-command-injection-vulnerability-in)