CVE-2026-9862: Fortra BoKS Auto-Registration Service Becomes Gateway for Critical RCE

On June 15, 2026, CVE-2026-9862 was disclosed — a critical OS command injection vulnerability in the boks_autoregisterd service of Fortra BoKS Core Privileged Access Manager. With a CVSS 9.8 score, an unauthenticated remote attacker can execute arbitrary shell commands on the privileged access master server.

On June 15, 2026, CVE-2026-9862 was publicly disclosed — an OS command injection vulnerability in the boks_autoregisterd service of Fortra BoKS Core Privileged Access Manager. The CVSS v3.1 score is 9.8, rated CRITICAL: a remote attacker, without authentication or user interaction, can execute arbitrary commands on the master server that acts as the privileged access broker for the entire enterprise environment. The severity stems not only from ease of exploitation but from the nature of the target: whoever controls the PAM controls who can access what.

Key Takeaways

The boks_autoregisterd service listens on TCP port 6507 and processes client auto-registration requests by concatenating user input into shell commands without sanitization.
CVSS v3.1 is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network, low complexity, no privileges or interaction required.
Affected versions: boks-server from 8.1.0.0 to 8.1.0.22 and from 9.0.0.0 to 9.0.0.4; fixes available in builds 8.1.0.23 and 9.0.0.5.
At time of writing, the CVE is not listed in the CISA KEV catalog and no verified public PoCs exist, but the EPSS indicates an exploitation probability that warrants attention.

The Mechanism: When Auto-Registration Becomes Code Execution

The boks_autoregisterd service is designed to automate onboarding of BoKS clients into the PAM system. During the auto-registration phase, received input is concatenated into a shell command without passing through parameterized execution primitives or undergoing metacharacter neutralization. According to SentinelOne, characters such as ;, |, `, and $() alter the intended command syntax, allowing injection of arbitrary instructions. The CWE-78 classification confirms the nature of the flaw: improper neutralization of special elements used in an OS command.

The service typically operates with elevated privileges on the BoKS master machine, as the latter is the node that mediates privileged access across the managed infrastructure. Command execution with these rights means compromise of the single service translates into effective control over the central authentication and authorization broker.

Why the BoKS Master Is a High-Value Target

Privileged Access Manager systems are not ordinary servers: they centralize credentials, access policies, and session logs for administrative, root, database, and critical application accounts. An attacker who gains control does not merely move laterally: they can redefine who has access to what, erase traces of prior access, or create persistent accounts with elevated privileges on downstream systems. The chain of trust inverts: the guardian becomes the entry point.

The vector is particularly insidious because it exploits a "convenience" feature — automatic auto-registration — that operations teams tend to leave enabled to reduce deployment overhead. TCP port 6507, if exposed or reachable from insufficiently isolated network segments, provides a direct touchpoint with the vulnerable logic. No prior credentials or social interaction are required: the attack is purely network-based.

"A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing" — Fortra, via official CVE record

Timeline and Current Threat Status

The vulnerability was discovered on May 27, 2026. Public disclosure occurred on June 15, 2026. Four months later, as of October 4, 2026, the situation presents conflicting elements: on one hand, the EPSS (Exploit Prediction Scoring System) on June 18, 2026 showed a score of 0.845% (percentile 53.17), indicating rare exploitation; on the other, attack surface monitoring sources report scanning activity, though without attribution to verifiable primary sources.

The CVE does not appear in the CISA KEV catalog. No verified public PoCs exist in major exploit databases. This profile — high theoretical severity, exploitation not yet documented conclusively — is typical of the time windows preceding large-scale adoption by threat actors. The reaction time of organizations running BoKS measures the margin between managed exposure and compromise.

Immediate Actions

Priority actions for organizations managing BoKS infrastructures are as follows, drawn from available primary sources:

Verify installed version: check whether the BoKS server falls within affected ranges — boks-server 8.1.0.0-8.1.0.22 or 9.0.0.0-9.0.0.4 — and plan upgrade to builds 8.1.0.23 or 9.0.0.5, respectively.
Apply documented technical workaround: if upgrade is not immediately feasible, comment out the line autoregisterd:300:1:0:respawn::$BOKS_lib/boks_autoregisterd -xn in file $BOKS_var/internal/boksinit/master to disable the vulnerable service.
Assess network reachability: verify whether TCP port 6507 is exposed to unauthorized segments and restrict service visibility to only client nodes that actually require auto-registration.
Monitor attack surface: include the CVE in intelligence feeds and vulnerability management processes, with attention to potential entry into the CISA KEV catalog which would recalibrate operational priority.

The Fragility of Convenience Services in the Critical Perimeter

CVE-2026-9862 is not a case of algorithmic complexity or cryptographic bug: it is an uncontrolled string concatenation, a pattern known for decades. Its danger derives from context — a PAM master — and the architectural choice to expose automated functionality on network-accessible channels. Auto-registration reduces operational deployment cost but transfers risk to the executable security plane. When that plane coincides with the broker of all privileged access, the initial time savings can be paid for with compromise of the entire control chain.

The rarity of documented exploitation to date does not justify delay: EPSS measures trends, not guarantees, and the simplicity of the mechanism — shell metacharacters on unsanitized input — lowers the cost of developing a working exploit. For organizations with BoKS instances in production, version verification and assessment of auto-registration necessity are the immediate steps.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter