Back mondoo.com

Mondoo: CVE-2026-9862

mondoo.com • October 4, 2026

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OS Command Injection Vulnerability in Fortra BoKS Core A critical OS command injection vulnerability, CVE-2026-9862, has been discovered in Fortra's BoKS Core Privileged Access Manager. This flaw, rated CVSS 9.8, allows unauthenticated remote attackers to execute arbitrary commands with elevated privileges via the boks_autoregisterd service. Organizations using BoKS for privileged access management are at risk of full system compromise. Although there are no confirmed breaches, the vulnerability is under active scrutiny in the security community. The flaw was publicly disclosed on June 15, 2026, and has led to widespread scanning attempts. Immediate patching is recommended, as the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The affected service listens on TCP port 6507 and is critical for managing privileged access across enterprises. 1 sources 71

Extracted Entities

Mondoo: CVE-2026-9862

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)