CVE-2026-12627

Fortra Core Privileged Access Manager (BoKS) has a stack-based buffer overflow (CWE-121) in the boks_autoregisterd autoregistration service. A remote attacker who can reach that service over the network can trigger memory corruption while the daemon processes a client response, with no authentication or user interaction required. The CVSS 3.1 score is 9.8 (critical), with high impact to confidentiality, integrity, and availability on the affected host. Organizations running BoKS with the autoregistration service exposed are in scope; affected version ranges are not stated in the available data. There is no known public proof of concept and the issue is not listed in CISA KEV.

What to do: Treat network access to the BoKS autoregistration service (boks_autoregisterd) as untrusted and restrict it to known clients only, ideally not reachable from the internet. Apply the vendor fix for CVE-2026-12627 as soon as Fortra publishes a patched release; no fixed version is named in the available data. Until then, monitor the service for crashes or unexpected client responses and review firewall rules that expose it.