Fortra Core Privileged Access Manager (BoKS): Stack buffer overflow in autoregistration
Summary
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow in the boks_autoregisterd service. A remote, unauthenticated attacker with network access to the service may be able to corrupt memory during processing of client responses. The vendor documents memory corruption; code execution has not been confirmed, and no exploitation is reported as of the time of writing.
Affected
- Fortra Core Privileged Access Manager (BoKS) 8.1.0.0 to 8.1.0.23
- Fortra Core Privileged Access Manager (BoKS) 9.0.0.0 to 9.0.0.6
- Default configuration is unaffected; the autoregistration service must be running.
Fixed in
- Upgrade to boks-server 8.1.0.24 or 9.0.0.7 (per CVE record; mapping to be verified with Fortra).
- Entra ID users: postpone upgrade to s-9.0.0.7 until c-9.0.0.7 is available and upgrade server and client components together, according to release notes.
Workaround
- Restrict network access to boks_autoregisterd (port 6507 by default) to trusted hosts only.
- Check boks_portmux exposure as well.
- If autoregistration is not required, disable the boks_autoregisterd service until fixed builds are installed; verify with Fortra first, as this may affect client registration.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV.
- No public exploit code confirmed at the time of research; a private PoC cannot be ruled out.
Our recommendation
- Inventory whether BoKS (boks-server) is deployed and which version runs.
- Restrict port 6507 to trusted hosts now and check boks_portmux exposure.
- Confirm the fix mapping and Entra ID guidance with Fortra before upgrading to 8.1.0.24 or 9.0.0.7.
- Apply the vendor fix as soon as it is verified and monitor for updates; the same service had a critical command injection (CVE-2026-9862) in June 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortra Advisory FI-2026-017 www.fortra.com
- OpenCVE CVE-2026-12627 app.opencve.io
- BoKS Manager Release Notes hstechdocs.helpsystems.com
- Fortra Security Research www.fortra.com
- GitHub Advisory GHSA-32v6-8gq7-4gxm github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:37.
Original description (NVD)
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.