Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-12627

Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-14316

Heap buffer overflow in boks_sshd revoked-key error handling

The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-9864

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-9862

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks) Core Privileged Access Manager Server
CVE-2026-9863

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks) Core Privileged Access Manager Server