CVE-2026-79898

Fortra BoKS Manager's crlserver component contains an OS command injection flaw (CWE-78) in which shell command substitution embedded in a CRL URL is executed as root on the BoKS Master. The vulnerability is triggered by an authenticated user who is authorized to add CRL URLs through the BCC (BoKS administration console), the WSI REST or SOAP API, or the cacrl command-line interface; BCC and WSI are network-accessible and need no local sudo/suexec rule, while non-root cacrl use does. Successful exploitation yields full root command execution on the BoKS Master, the server that centrally stores and enforces privileged access policy, so compromise of it has broad blast radius (CVSS 9.1, scope changed). Organizations running BoKS Manager with CRL administration enabled are affected, particularly where BCC/WSI endpoints are reachable from broader networks or where delegated users hold CRL-management rights. The flaw is not in the CISA KEV catalog and no public proof of concept is known, so exploitation is presumed absent or at most targeted at this time.

What to do: Apply the fixed version from Fortra's advisory for BoKS Manager as soon as it is available for your release line. Until patched, restrict network access to the BCC and WSI REST/SOAP endpoints to dedicated admin hosts, minimize the set of users authorized to add CRL URLs, and remove unnecessary sudo/suexec rules permitting non-root cacrl use. Audit existing CRL URL configuration and crlserver/root execution logs for command substitution patterns (e.g., backticks or $() sequences) indicating prior tampering.