Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Core Privileged Access Manager can let remote attackers corrupt memory

CVE-2026-12627 · published 17 days ago
Summary

The Core Privileged Access Manager component that handles automatic device registration can be tricked into overwriting its own memory when it processes a response from a client. An attacker who can reach this service over the network could cause the program to crash or potentially take control of it. Install the vendor’s security update or upgrade to the latest version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fortra fortra's core privileged access manager (boks) <= 8.1.0.23
Original advisory text
Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-12627 · NVD
CVE-2026-12627 · MITRE
Track software like this
Free during beta