Fortra BoKS Manager: Command injection in crlserver
Summary
Fortra BoKS Manager (boks-server) contains a command injection flaw in the crlserver component that processes configured CRL URLs. An authenticated user who is authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface can inject shell command substitution, which crlserver executes as root on the BoKS Master. Successful exploitation gives full control over the BoKS Master, which manages access across connected Unix and Linux systems. Exploitation requires valid credentials with CRL-URL rights; no public exploit or in-the-wild exploitation is known.
Affected
- boks-server 8.1.0.0 to 8.1.0.23
- boks-server 9.0.0.0 to 9.0.0.6
- Default configuration: unknown
Fixed in
- boks-server 8.1.0.24 (8.1 line)
- boks-server 9.0.0.7 (9.0 line)
Workaround
- No vendor-documented workaround known.
- Restrict access to BCC and WSI to trusted administration hosts.
- Review which accounts hold CRL-URL rights and remove unneeded rights.
Exploitation
- Authenticated attack required, with CRL-URL add rights in BCC or WSI, or sudo/suexec access for cacrl.
- No public proof of concept known.
- No evidence of in-the-wild exploitation; not listed in CISA KEV according to one secondary source.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory BoKS Manager installations and confirm the boks-server version.
- Patch to 8.1.0.24 or 9.0.0.7, depending on the installed line.
- Review CRL-URL rights and restrict BCC and WSI access to trusted admin hosts.
- Monitor CRL-URL change history and child processes of crlserver on the BoKS Master.
- Verify the fixed versions in Fortra advisory FI-2026-015 before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortra advisory FI-2026-015 www.fortra.com
- OpenCVE CVE-2026-79898 app.opencve.io
- VulDB 412700 vuldb.com
- SecurityWeek: Fortra patches critical vulnerabilities in BoKS www.securityweek.com
- Fortra BoKS release notes hstechdocs.helpsystems.com
- TheHackerWire CVE-2026-79898 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:46.
Original description (NVD)
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.