CVE-2026-9863
published 2026-06-15CVE-2026-9863: Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A…
PriorityP352high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.58%
43.3th percentile
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortra | core_privileged_access_manager | boks-server 8.1.0.0 – boks-server 8.1.0.22 | — |
| fortra | core_privileged_access_manager | boks-server 9.0.0.0 – boks-server 9.0.0.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Fortra Core Privileged Access Manager os command injection
vuldb·2026-06-15·CVSS 7.5
CVE-2026-9863 [HIGH] Fortra Core Privileged Access Manager os command injection
A vulnerability classified as critical was found in Fortra Core Privileged Access Manager. Affected is an unknown function. Executing a manipulation can lead to os command injection.
This vulnerability is registered as CVE-2026-9863. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
GHSA
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations.
ghsa_unreviewed·2026-06-15
CVE-2026-9863 [HIGH] CWE-78 Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations.
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-15
Published