Critical Fortra Access Manager CVE-2024-0763 lets attackers inject commands

Key Takeaways

• A critical command injection flaw (CVE-2026-9862) has been discovered in Fortra’s Core Privileged Access Manager (BoKS).
• The vulnerability, rated 9.8 CVSS, allows unauthenticated remote attackers to execute arbitrary commands on affected systems.
• The flaw resides in the boks_autoregisterd service, which listens on TCP port 6507 by default.
• Fortra has released an advisory (FI-2026-007) detailing temporary mitigations while permanent patches are developed.

Fortra has issued a warning regarding a severe security vulnerability within its Core Privileged Access Manager (BoKS) software. This critical flaw, identified as CVE-2026-9862, could enable remote attackers to execute arbitrary operating system commands on vulnerable systems, posing a significant risk to organizations.

Understanding the Vulnerability

The vulnerability is an OS command injection (CWE-78) flaw found within the boks_autoregisterd service of BoKS. This service is integral to the product’s autoregistration functionality, which automates the process of adding hosts to the privileged access management environment.

Rated with a CVSS score of 9.8, the flaw stems from improper neutralization of user-supplied input. This allows attackers to craft malicious requests during the autoregistration process, injecting and executing arbitrary commands on the underlying operating system. Security researchers have noted that the vulnerable service typically operates on TCP port 6507, making it accessible over the network in many default deployments.

Exploitation and Impact

An unauthenticated attacker with network access to the boks_autoregisterd service can exploit CVE-2026-9862 without requiring any user interaction or pre-existing privileges. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the service, which can lead to a complete system compromise. The potential consequences include data manipulation, full system control, and disruption of critical services.

Given the severe nature of this vulnerability and the absence of authentication requirements for exploitation, it presents a substantial threat to organizations relying on BoKS for their privileged access management needs. Attackers could leverage this weakness to facilitate lateral movement within networks, escalate privileges, or deploy malicious software.

Fortra’s Response and Mitigation

Fortra has acknowledged the vulnerability, as detailed in advisory FI-2026-007. The flaw was initially identified on May 27, 2026, and publicly disclosed on June 15, 2026. While security updates are under development, Fortra has provided temporary mitigation strategies.

Organizations are strongly urged to restrict network access to the boks_autoregisterd service. This can be achieved by implementing stringent firewall rules or network segmentation to limit exposure of port 6507, especially from untrusted network segments.

As an additional workaround, administrators can entirely disable the vulnerable service. This involves editing the boksinit configuration file on the BoKS Master system to comment out the autoregisterd service entry. After modifying the configuration, the service manager must be reloaded, or the BoKS service restarted for the changes to take effect. While effective in preventing exploitation, this action will disable the autoregistration functionality until the configuration is reverted.

Security teams should actively monitor their environments for any suspicious activity related to the autoregistration service, including unexpected command execution events or unusual network traffic targeting port 6507. Applying vendor-provided patches promptly upon their release will be essential for a complete remediation of this critical risk.

The disclosure of CVE-2026-9862 highlights the persistent dangers associated with exposed management services and underscores the critical importance of robust secure coding practices, particularly rigorous input validation, to prevent command injection vulnerabilities.

What You Should Do

• Immediately restrict network access to the boks_autoregisterd service (TCP port 6507) using firewalls or network segmentation.
• Consider temporarily disabling the boks_autoregisterd service by commenting out its entry in the boksinit configuration file on the BoKS Master system, then reloading the service manager or restarting BoKS.
• Monitor your network and systems for any unusual activity targeting port 6507 or unexpected command execution.
• Prepare to apply official vendor patches as soon as Fortra releases them to fully address the vulnerability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.