CVE-2026-12627

Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

No known exploitation. EPSS puts it in the 37th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile37th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-10-01Updated 2026-10-01Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Fortra's Core Privileged Access ManagerAffected: ≥ 8.1.0.0, ≤ 8.1.0.23Upgrade to: after 8.1.0.23Affected: ≥ 9.0.0.0, ≤ 9.0.0.6Upgrade to: after 9.0.0.6Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Fortra Core Privileged Access Manager (BoKS) and confirm its version.
If the autoregistration service is exposed to any network, immediately restrict access to port 6507 or disable the boks_autoregisterd service until patched.
Upgrade to boks-server 8.1.0.24 or 9.0.0.7, whichever matches your branch.
Confirm with your vendor/support contact that the fix has been applied and the service is reachable only from trusted hosts.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

In plain language

Written by AI from the record

A critical flaw in Fortra's BoKS privileged access management software lets an outside attacker take over the system remotely without a password, and if you run BoKS you should patch it now.

Unauthenticated remote stack-based buffer overflow (CWE-121) in the boks_autoregisterd component of Fortra BoKS, triggered by crafted client-response data sent to the autoregistration service (default port 6507), enabling full memory corruption and likely remote code execution.

If you're affected

Full privileged access system takeover
Loss of control over all managed credentials
Operational disruption across managed servers
Compliance/audit failure
Gateway to broader network compromise

What is it

BoKS is like the master keyring for your IT staff — it controls who gets privileged access to your servers. This flaw is like a broken lock on a side door to that keyring room: someone outside, with no key at all, can send a specially crafted message and potentially get full control of the system that manages everyone else's access.

Who is affected

This matters to you if you run Fortra's Core Privileged Access Manager (BoKS) anywhere in your environment, especially if its autoregistration service is reachable from your network or the internet — which is the default configuration, so no special setup is needed for an attacker to try it.

How urgent is it

This is a severe, easy-to-trigger flaw: an attacker needs no credentials and no user to click anything, just network access to a service that's exposed by default, and it can hand them control of the system that manages your privileged accounts. There's no confirmed active exploitation or public exploit code yet, but given the critical severity and how exposed this component typically is, treat this as urgent and patch before attackers catch up.

What to do — in detail

Inventory all BoKS server deployments and identify current boks-server version. 2. Determine whether boks_autoregisterd (default TCP/6507) is reachable from untrusted networks, including internal segments outside your trust boundary. 3. As an immediate mitigation, firewall off port 6507 to only known client IPs, or disable boks_autoregisterd entirely if autoregistration isn't actively used. 4. Upgrade to the fixed release matching your branch: boks-server 8.1.0.24 (8.x line) or 9.0.0.7 (9.x line) — check vendor release notes for any migration/breaking-change guidance specific to your branch before upgrading production. 5. After patching, verify the service version and re-test exposure. 6. Not in CISA KEV and no public PoC or exploitation reported at this time, so there's no mandated remediation deadline, but monitor Fortra advisories and threat intel for a shift to active exploitation given the high CVSS and trivial attack path.

Technical context

CVSS 3.1 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction, high impact to confidentiality, integrity and availability. Weakness is CWE-121 (stack-based buffer overflow) in client-response processing within boks_autoregisterd. Not listed in CISA KEV; no dated news reporting of in-the-wild exploitation; no public exploit code identified. EPSS predicts low near-term exploitation likelihood, consistent with absence of observed attacks, but this reflects prediction only and should not be used to downgrade urgency given the severity and default-exposed attack surface.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS37th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 37th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 0 days, from the signal feeds we watch.

2026-10-01Patch availablepatch available, patch available, workaround available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated

Affected products

Fortracommercial · USaka filecatalyst workflow, goanywhere mft, goanywhere managed file transfer
- Fortra's Core Privileged Access Manager (BoKS)On-premEnterprise Software / document-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable