Exploitation ongoing with high activity in latest observed window (1 mentions)
Immediate actions
Patch fortra core_privileged_access_manager_server systems immediately
Assume compromise if assets are exposed
Recommended action window: Immediate (within 24h)
NVD description
Fortra's
Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Vulnerabilidad en Fortra Access Manager permite ataques de inyección de comandos remotos
Fortra ha revelado una vulnerabilidad de seguridad crítica ( CVE-2026-9862 ) en su gestor Core Privileged Access Manager (BoKS)
https://blog.elhacker.net/2026/06/vulnerabilidad-en-fortra-access-manager.html
Post summary
Fortra has disclosed a critical remote command injection vulnerability (CVE‑2026‑9862) in its Core Privileged Access Manager (BoKS), as reported by a Spanish security blog.
🚨 GÜVENLİK BÜLTENİ: Fortra BoKS Sistemlerinde Kritik Komut Enjeksiyonu Zafiyeti (CVE-2026-9862)!
Merhaba #Brolyz
Ayrıcalıklı erişim yönetimi (PAM) çözümlerini ilgilendiren kritik bir güvenlik açığı ortaya çıktı. Fortra Core Privileged Access Manager (BoKS) yazılımında tespit edilen ve CVSS 9.8 puanına sahip bu zafiyet, özellikle Linux altyapıları yöneten #orta ve büyük ölçekli kurumlar için ciddi risk oluşturuyor.
📌 Özet:
CVE-2026-9862, BoKS'un otomatik kayıt servisi olan boks_autoregisterd bileşenindeki bir OS Komut Enjeksiyonu (CWE-78) hatasından kaynaklanıyor. Kimlik doğrulama gerektirmeyen bu açık sayesinde saldırganlar, ağ üzerinden erişebildikleri sistemlerde yüksek yetkilerle rastgele komut çalıştırabiliyor.
⚠️ Riskler
• Kimlik bilgisi gerekmeksizin Uzaktan Komut Çalıştırma (RCE)
• Kritik sunuculara erişimi yöneten PAM altyapısının ele geçirilmesi
• Ağ içinde yatay hareket (lateral movement) ve kalıcılık sağlanması
• Hassas verilerin dışarı sızdırılması
🛠️ Çözüm ve Öneriler
1️⃣ Ağ Erişimini Kısıtlayın: Varsayılan olarak 6507 portunu kullanan boks_autoregisterd servisine dış erişimi firewall ve ACL kurallarıyla sınırlandırın.
2️⃣ Servisi Geçici Olarak Devre Dışı Bırakın: BoKS 8.1 ve 9.0 sürümlerinde autoregisterd servisini konfigürasyon üzerinden kapatarak saldırı yüzeyini azaltın.
3️⃣ Konfigürasyonu Yeniden Yükleyin: Yapılan değişikliklerin aktif olması için ilgili servisi yeniden başlatın veya yapılandırmayı yeniden yükleyin.
4️⃣ Yama Sürecini Hızlandırın: Fortra tarafından yayınlanacak güvenlik güncellemelerini öncelikli olarak planlayın ve etkilenen sistemlerde sürüm kontrolü gerçekleştirin.
Kritik erişim yönetimi altyapılarınızı korumayı geciktirmeyin. Güvenli haftalar dilerim! 🛡️
Post summary
The bulletin announces a critical OS command injection flaw (CVE‑2026‑9862) in Fortra BoKS, details its exploitation vector and severity, and outlines mitigation steps such as disabling the autoregisterd service, restricting port access, and applying upcoming vendor patches.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE DAILY — June 15, 2026
1️⃣ SHINYHUNTERS HIT 100+ UNIVERSITIES VIA ORACLE PEOPLESOFT ZERO-DAY
The ShinyHunters threat group has exploited an unpatched Oracle PeopleSoft remote code execution vulnerability (CVE-2026-35273) to breach over 100 organizations, predominantly in the education sector. The exploit requires no authentication, meaning attackers could gain full system access simply by reaching the vulnerable server. Data was already exfiltrated before Oracle released a patch on June 10, leaving many institutions scrambling to assess the damage. This attack highlights the critical importance of timely patching and network segmentation, especially for organizations running legacy enterprise software.
@JNitterauer
2️⃣ PALO ALTO PAN-OS VPN BYPASS EXPLOIT — CISA KEV LISTED
Palo Alto Networks disclosed an active exploit targeting their PAN-OS platform (CVE-2026-0257) that allows attackers to completely bypass VPN authentication without any credentials. The flaw has been added to the CISA Known Exploited Vulnerabilities catalog, meaning affected organizations are expected to patch immediately under federal guidance. Anyone running GlobalProtect VPN solutions needs to verify their PAN-OS version and apply the latest security update across all endpoints today.
@JNitterauer
3️⃣ FORTRA CORE PRIVILEGED ACCESS MANAGER COMMAND INJECTION
VulDB has flagged an increased severity rating for CVE-2026-9862, an operating system command injection vulnerability in Fortra Core Privileged Access Manager. This product is designed to protect sensitive credentials and control access to critical systems, making a flaw in its architecture particularly dangerous. A successful exploit could allow attackers to execute arbitrary commands on the underlying system, potentially compromising the entire privileged access infrastructure it was meant to secure.
@vuldb
4️⃣ CLICKHOUSE CELEBRATES 10 YEARS AS OPEN-SOURCE ANALYTICAL DATABASE
ClickHouse marks its 10th anniversary today — Alexey Milovidov originally open-sourced the project on June 15, 2016, built to handle 100 billion daily records. A decade and over 2,000 contributors later, it has grown into the most popular open-source analytical database worldwide, powering real-time analytics for companies from Cloudflare to Netflix. The milestone underscores the enduring power of the open-source model in building enterprise-grade infrastructure that rivals proprietary solutions.
@ClickHouseDB
5️⃣ MODRINTH JOINS SPARK UNIVERSE — STAYING OPEN SOURCE
Modrinth, the popular open-source Minecraft modding platform, has announced it is joining the Spark Universe ecosystem. Despite community concerns about acquisitions potentially threatening open-source commitments, the developers have confirmed the platform will remain fully open source and will not merge with the proprietary Essential client. The Iris Shaders developer noted that under these conditions, the move appears positive, as Modrinth retains its independence in the areas that matter most to users.
@IrisShaders
6️⃣ ATHENA COALITION LAUNCHES TO PROTECT OPEN SOURCE FROM AI ATTACKS
Chainguard has launched Athena, an industry coalition dedicated to defending open-source software from AI-powered attacks. The initiative is already operational with more than two dozen member organizations, having processed over 20,000 security findings and generated 2,000+ patches across 500+ open-source projects. As AI tools lower the barrier for automated vulnerability scanning and exploit generation, coordinated defense efforts like Athena become essential for maintaining the integrity of the open-source ecosystem.
@chainguard_dev
7️⃣ TRAPDOOR MALWARE CAMPAIGN TARGETS DEVELOPER WORKSTATIONS
Security researcher Sanchit Vir Gogia highlighted a compelling CSO Online report on the TrapDoor malware campaign, which is forcing CISOs to fundamentally rethink how they secure developer workstations. Rather than targeting end-user systems, TrapDoor has moved security attacks inside the software factory itself, treating developer machines as enterprise control-plane infrastructure. This shift reflects a broader trend where threat actors recognize that compromising the build pipeline is far more effective than attacking the final product.
@s_v_g
8️⃣ ONYXC2 MALWARE HARVESTS CREDENTIALS FROM 200+ APPLICATIONS
A new malware strain called OnyxC2 has emerged, targeting over 200 applications and browser extensions to harvest credentials, session tokens, and authentication data across nearly any software stack. What makes OnyxC2 particularly dangerous is its modular and adaptive design — it can reconfigure itself to extract data from different environments, making traditional signature-based detection ineffective. Security teams need to implement behavioral monitoring and credential rotation strategies to mitigate the risk of silent compromise.
@JNitterauer
💭 The security landscape this week paints a concerning picture: from zero-days in enterprise software to adaptive malware targeting the entire application ecosystem, threat actors are getting more sophisticated while attack surfaces only grow. The response is equally multifaceted — coordinated coalitions like Athena defending open source, rapid patching cycles for critical CVEs, and a fundamental rethinking of how we protect developer infrastructure. The common thread? Security is no longer a perimeter problem; it's an everywhere problem.
Which of these threats should your organization prioritize patching first — the PeopleSoft zero-day, the Palo Alto VPN bypass, or the OnyxC2 credential harvester? 👇
#CyberSecurity#OpenSource#ZeroDay#ThreatIntel#Malware#DataBreach
Post summary
The post highlights multiple actively exploited vulnerabilities: an Oracle PeopleSoft RCE that has already been leveraged in the wild, a Palo Alto PAN‑OS VPN bypass now listed by CISA, and a Fortra command‑injection flaw, underscoring the urgency of applying patches and conducting rapid incident response.
A critical Fortra BoKS vulnerability (CVE-2026-9862) enables remote OS command injection via the autoregistration service. Mitigate now.
#Fortra#BoKS#CVE20269862#InfoSec
https://securityonline.info/fortra-boks-vulnerability
Post summary
The statement announces a critical remote OS command injection vulnerability in Fortra BoKS' autoregistration service and urges immediate mitigation.
The severity is increased for this new vulnerability affecting Fortra Core Privileged Access Manager (CVE-2026-9862) https://vuldb.com/vuln/370929
Post summary
The tweet states a severity increase for Fortra Core Privileged Access Manager CVE-2026-9862 with a link to a vulnerability database entry, but offers no PoC, exploit, patch, or detailed technical information.
Some increased actor activities are shown targeting Fortra Core Privileged Access Manager (CVE-2026-9862) https://vuldb.com/vuln/370929/cti
Post summary
The post alerts to increased actor interest in exploiting Fortra Core Privileged Access Manager (CVE-2026-9862) but offers no specific exploit, patch, or technical details.
