PT-2026-49245 · Fortra · Ca Privileged Access Manager

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-9862

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-9862

Affected Products

Ca Privileged Access Manager

References · 2

• https://fortra.com/security/advisories/product-security/fi-2026-007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9862 · Security Note