CVE-2026-9863

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

Score

CVSS 3.1 8.8 High

Status

Analyzed - df4dee71-de3a-4139-9588-11b62fe6c0ff

Published

2026-06-15

Last modified

2026-10-25

Weaknesses

CWE-78

Affected products

• Core Privileged Access Manager Boks (Fortra)
• Core Privileged Access Manager Server (Fortra)

References

• https://www.fortra.com/security/advisories/product-security/fi-2026-008