# CVE-2026-9862: Unauthenticated OS Command Injection in Fortra Core Privileged Access Manager (BoKS) boks_autoregisterd

> CVE-2026-9862 is a CVSS 9.8 unauthenticated OS command injection (CWE-78) in the boks_autoregisterd autoregistration service of Fortra Core Privileged Access Manager (BoKS), reachable by default on TCP/6507. Insufficient input sanitization lets a remote, unauthenticated attacker inject OS commands that execute with the service's (typically root) privileges on the BoKS Master, leading to full compromise of the privileged-access-management control plane. Fixed in BoKS 8.1.0.23 and 9.0.0.5; no public PoC and no observed in-the-wild exploitation at disclosure.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-06-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0885
- **ID:** TL-2026-0885
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-9862, CVE-2026-9863

## Description

Fortra Core Privileged Access Manager (BoKS), formerly HelpSystems/PowerTech BoKS Manager, is an enterprise privileged-access-management (PAM) product for Linux and UNIX fleets. A central BoKS Master (with Replicas) brokers and enforces privileged access, SSH key management, keystroke logging, and least-privilege policy across managed hosts. Because the Master is the security control plane for an entire UNIX estate, a remote compromise of it is effectively a compromise of every host it governs.

CVE-2026-9862 is an OS command injection vulnerability (CWE-78, Improper Neutralization of Special Elements used in an OS Command) in the boks_autoregisterd daemon. This service implements the host autoregistration workflow, by which new client systems register themselves into the BoKS domain. The daemon listens by default on TCP port 6507 and, in many deployments, is network-reachable. Due to insufficient sanitization of attacker-controlled input handled during autoregistration processing, a crafted registration request can embed shell metacharacters (for example ';', '|', '`', or '$( )') that break out of the intended command context and are passed to an OS command interpreter. The injected commands execute with the privileges of the boks_autoregisterd service, which on the BoKS Master typically runs as root.

The CVSS 3.1 base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. Fortra's advisory states successful exploitation 'enables the execution of arbitrary commands with the service's privileges, which can lead to full system compromise, data manipulation, or service disruption.' Because the target is a PAM Master, post-exploitation impact extends well beyond a single host: an attacker can harvest stored privileged credentials and SSH keys, manipulate access policy, and pivot laterally across the managed UNIX fleet that BoKS centrally administers.

The flaw was identified by Fortra on May 27, 2026 and publicly disclosed on June 15, 2026 under advisory FI-2026-007, alongside a sibling command-injection flaw, CVE-2026-9863, in the boks_upgrade utility. Affected releases are BoKS server 8.1.0.0 through 8.1.0.22 and 9.0.0.0 through 9.0.0.4. Fixes shipped the same day in BoKS server 8.1.0.23 (which must be installed together with client package c-8.1.0.29 on Master or Replica systems) and 9.0.0.5. As of June 20, 2026 there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog; EPSS is approximately 0.845% (~53rd percentile). The combination of unauthenticated network RCE, low attack complexity, and a high-value PAM target nonetheless makes this a priority-patch vulnerability. No threat-actor attribution and no real-world C2 or exploitation infrastructure are associated with this CVE; the indicators below are defensive hunting signals derived from the vulnerable service's mechanics, not observed adversary infrastructure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1136 Create Account
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1565 Data Manipulation
- T1489 Service Stop

## Sources

- [NVD - CVE-2026-9862](https://nvd.nist.gov/vuln/detail/CVE-2026-9862)
- [Fortra Product Security Advisory FI-2026-007](https://www.fortra.com/security/advisories/product-security/fi-2026-007)
- [GitHub Advisory Database - GHSA-32v6-8gq7-4gxm (CVE-2026-9862)](https://github.com/advisories/GHSA-32v6-8gq7-4gxm)
- [Critical Fortra Access Manager Vulnerability Lets Attackers Execute Arbitrary Commands](https://cybersecuritynews.com/fortra-access-manager-vulnerability/)
- [Fortra Access Manager Security Flaw Exposes Systems to Command Injection](https://gbhackers.com/fortra-access-manager-security-flaw/)
- [Fortra Core PAM (BoKS) OS Command Injection (CVE-2026-9862)](https://www.thehackerwire.com/fortra-core-pam-boks-os-command-injection-cve-2026-9862/)
- [Fortra BoKS Manager Release Notes (fixed in 8.1.0.23 / 9.0.0.5)](https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Powertech/BoKSManager.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0885