Review reviewHigh

CVE-2026-9863

Fortra Core Privileged Access Manager (BoKS), core privileged access manager server

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

CVSS: 8.8
EPSS: 0.60%
CISA KEV: Not listed
Published: 2026.06.16

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.60%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Fortra Core Privileged Access Manager (BoKS), core privileged access manager server
Affected versions: >= boks-server 8.1.0.0 <= boks-server 8.1.0.22, >= boks-server 9.0.0.0 <= boks-server 9.0.0.4, >= 8.1.0.0 < 8.1.0.23, >= 9.0.0.0 < 9.0.0.5
Fixed versions: 8.1.0.23, 9.0.0.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Fortra Core Privileged Access Manager (BoKS), core privileged access manager server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-78