---
id: CVE-2026-9863
title: >-
  Fortra BoKS Manager contains an OS command injection vulnerability in the
  client upgrade and patch tooling for legacy tar-based client installations
summary: >-
  Fortra BoKS Manager contains an OS command injection vulnerability in the
  client upgrade and patch tooling for legacy tar-based client installations. A
  malicious or compromised legacy tar-installed client selected for upgrade or
  patching…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: fortra
product: core_privileged_access_manager_server
affected:
  - 'core_privileged_access_manager_server >= 8.1.0.0, < 8.1.0.23'
  - 'core_privileged_access_manager_server >= 9.0.0.0, < 9.0.0.5'
patched:
  - core_privileged_access_manager_server 9.0.0.5
published: '2026-06-15'
updated: '2026-07-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9863'
references:
  - url: 'https://www.fortra.com/security/advisories/product-security/fi-2026-008'
    label: df4dee71-de3a-4139-9588-11b62fe6c0ff
tags:
  - nvd
epss: 0.00595
epssPercentile: 0.47171
ingestedAt: '2026-07-28T18:38:09.159Z'
---

## Overview

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

## Affected

- `core_privileged_access_manager_server >= 8.1.0.0, < 8.1.0.23`
- `core_privileged_access_manager_server >= 9.0.0.0, < 9.0.0.5`

## Remediation

Upgrade past the affected range:

- `core_privileged_access_manager_server 9.0.0.5`