CVE-2026-9863: fallo de gravedad alta en Fortra Core Privileged Access Manager (BoKS)
Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.6%
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Fortra · Core Privileged Access Manager (BoKS)CVEs relacionadas — Fortra Core Privileged Access Manager (BoKS)
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-9862CRITICALCore Privileged Access Manager (BoKS) autoregistration service command injection vulnerabilityEPSS 1.0%CVE-2026-14316HIGHHeap buffer overflow in boks_sshd revoked-key error handlingEPSS 0.2%CVE-2026-9864MEDIUMFortra BoKS Server Agent adjoin machine-account password generation vulnerabilityEPSS 0.1%CVE-2025-5141MEDIUMCore Privileged Access Manager (BoKS) Leakage of Sensitive Data via the CacheEPSS 0.1%CVE-2025-13532MEDIUMWeak Password Hash in Core Privileged Access Manager (BoKS)EPSS 0.1%