Threat reportVulnerabilityTL-2026-0885
CVE-2026-9862: Unauthenticated OS Command Injection in Fortra Core Privileged Access Manager (BoKS) boks_autoregisterd
CVE-2026-9862 (TL-2026-0885), also tracked as FI-2026-007, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-20. It has no confirmed attribution, affects Fortra Core Privileged Access Manager (BoKS) Server, references 2 CVEs (CVE-2026-9862, CVE-2026-9863), maps to 22 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-0885
- Threat ID
- TL-2026-0885
- Also known as
- FI-2026-007, GHSA-32v6-8gq7-4gxm
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- financial, government, telecommunications, technology, healthcare, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
How CVE-2026-9862 works
CVE-2026-9862 is a CVSS 9.8 unauthenticated OS command injection (CWE-78) in the boks_autoregisterd autoregistration service of Fortra Core Privileged Access Manager (BoKS), reachable by default on TCP/6507. Insufficient input sanitization lets a remote, unauthenticated attacker inject OS commands that execute with the service's (typically root) privileges on the BoKS Master, leading to full compromise of the privileged-access-management control plane. Fixed in BoKS 8.1.0.23 and 9.0.0.5; no public PoC and no observed in-the-wild exploitation at disclosure.
Fortra Core Privileged Access Manager (BoKS), formerly HelpSystems/PowerTech BoKS Manager, is an enterprise privileged-access-management (PAM) product for Linux and UNIX fleets. A central BoKS Master (with Replicas) brokers and enforces privileged access, SSH key management, keystroke logging, and least-privilege policy across managed hosts. Because the Master is the security control plane for an entire UNIX estate, a remote compromise of it is effectively a compromise of every host it governs.
CVE-2026-9862 is an OS command injection vulnerability (CWE-78, Improper Neutralization of Special Elements used in an OS Command) in the boks_autoregisterd daemon. This service implements the host autoregistration workflow, by which new client systems register themselves into the BoKS domain. The daemon listens by default on TCP port 6507 and, in many deployments, is network-reachable. Due to insufficient sanitization of attacker-controlled input handled during autoregistration processing, a crafted registration request can embed shell metacharacters (for example ';', '|', '`', or '$( )') that break out of the intended command context and are passed to an OS command interpreter. The injected commands execute with the privileges of the boks_autoregisterd service, which on the BoKS Master typically runs as root.
The CVSS 3.1 base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. Fortra's advisory states successful exploitation 'enables the execution of arbitrary commands with the service's privileges, which can lead to full system compromise, data manipulation, or service disruption.' Because the target is a PAM Master, post-exploitation impact extends well beyond a single host: an attacker can harvest stored privileged credentials and SSH keys, manipulate access policy, and pivot laterally across the managed UNIX fleet that BoKS centrally administers.
The flaw was identified by Fortra on May 27, 2026 and publicly disclosed on June 15, 2026 under advisory FI-2026-007, alongside a sibling command-injection flaw, CVE-2026-9863, in the boks_upgrade utility. Affected releases are BoKS server 8.1.0.0 through 8.1.0.22 and 9.0.0.0 through 9.0.0.4. Fixes shipped the same day in BoKS server 8.1.0.23 (which must be installed together with client package c-8.1.0.29 on Master or Replica systems) and 9.0.0.5. As of June 20, 2026 there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog; EPSS is approximately 0.845% (~53rd percentile). The combination of unauthenticated network RCE, low attack complexity, and a high-value PAM target nonetheless makes this a priority-patch vulnerability. No threat-actor attribution and no real-world C2 or exploitation infrastructure are associated with this CVE; the indicators below are defensive hunting signals derived from the vulnerable service's mechanics, not observed adversary infrastructure.
MITRE ATT&CK techniques used in TL-2026-0885
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery
Lateral Movement
Persistence
T1053 Scheduled Task/Job; T1098 Account Manipulation; T1136 Create Account; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1489 Service Stop; T1565 Data Manipulation
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in CVE-2026-9862
- Fortra — Core Privileged Access Manager (BoKS) Server
Vulnerable versions: 8.1.0.0 - 8.1.0.22; 9.0.0.0 - 9.0.0.4
Fixed in: 8.1.0.23 (with client c-8.1.0.29); 9.0.0.5
Remediation for CVE-2026-9862
Patches
- Upgrade BoKS server to 9.0.0.5 (9.0.x branch).
- Upgrade BoKS server to 8.1.0.23 (8.1.x branch); install simultaneously with client package c-8.1.0.29 on Master or Replica systems.
- Both June 15, 2026 releases also remediate the sibling boks_upgrade command-injection flaw CVE-2026-9863.
Immediate actions
- Restrict network access to TCP port 6507 (boks_autoregisterd) to trusted BoKS Master/Replica/client hosts only, via host firewall rules, security groups, or network segmentation.
- Inventory all BoKS Master and Replica systems and identify the running server version (8.1.x vs 9.0.x) to scope exposure to the 8.1.0.0-8.1.0.22 and 9.0.0.0-9.0.0.4 affected ranges.
- Monitor port 6507 and the BoKS Master for unexpected child processes (e.g. /bin/sh -c) spawned by boks_autoregisterd and for anomalous autoregistration requests.
Workarounds
- If patching is not immediately possible and autoregistration is not required, disable the service by editing the boksinit configuration file on the BoKS Master (comment out the autoregisterd entry) and reloading the BoKS service manager.
- Block or filter inbound TCP/6507 at the perimeter and between trust zones until patched.
Longer-term hardening
- Place BoKS Master/Replica management interfaces on a dedicated, tightly segmented management network not reachable from general user or internet-facing zones.
- Deploy host-based EDR/auditd on the BoKS Master with behavioral rules for command injection and unexpected process lineage under the PAM service account.
- Establish a recurring patch cadence for Fortra BoKS and subscribe to Fortra product-security advisories (FI-series) so PAM-control-plane CVEs are remediated on an expedited timeline.
CVEs associated with CVE-2026-9862
Weaknesses (CWE) in CVE-2026-9862
Timeline of CVE-2026-9862
- Fortra identifies the OS command injection vulnerability (CVE-2026-9862) in the boks_autoregisterd service of Core Privileged Access Manager (BoKS), tracked internally under advisory FI-2026-007.
- Alongside CVE-2026-9862, Fortra discloses the sibling OS command injection CVE-2026-9863 in the boks_upgrade utility under the same FI-2026-007 advisory; both are remediated by the 8.1.0.23 / 9.0.0.5 releases.
- Security press (Cyber Security News, GBHackers) report the flaw, emphasizing unauthenticated RCE on a privileged-access-management product and mitigation by restricting port 6507.
- GitHub Advisory Database publishes GHSA-32v6-8gq7-4gxm for CVE-2026-9862, recording affected ranges 8.1.0.0-8.1.0.22 and 9.0.0.0-9.0.0.4.
- Fortra releases fixed BoKS server packages 8.1.0.23 (paired with client c-8.1.0.29) and 9.0.0.5, remediating both CVE-2026-9862 (autoregisterd) and the sibling CVE-2026-9863 (boks_upgrade).
- Fortra publicly discloses CVE-2026-9862 via product-security advisory FI-2026-007, rating it CVSS 9.8 (Critical) for unauthenticated network OS command injection on default TCP port 6507.
- NVD publishes/updates the CVE-2026-9862 record (status Awaiting Analysis) with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and affected version configurations; EPSS approximately 0.845%.
- As of this assessment, no public proof-of-concept exists, no in-the-wild exploitation has been observed, and CVE-2026-9862 is not listed in the CISA KEV catalog.
Sources cited for CVE-2026-9862
- NVD - CVE-2026-9862
- Fortra Product Security Advisory FI-2026-007
- GitHub Advisory Database - GHSA-32v6-8gq7-4gxm (CVE-2026-9862)
- Critical Fortra Access Manager Vulnerability Lets Attackers Execute Arbitrary Commands
- Fortra Access Manager Security Flaw Exposes Systems to Command Injection
- Fortra Core PAM (BoKS) OS Command Injection (CVE-2026-9862)
- Fortra BoKS Manager Release Notes (fixed in 8.1.0.23 / 9.0.0.5)
Detection coverage for TL-2026-0885
As of 2026-06-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0885 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.