External risk intelligence

Fortra Core Privileged Access Manager Stack Buffer Overflow in boks_autoregisterd

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12627

The vulnerability exists in an autoregistration service component of a privileged access management product. While network-accessible, such services are typically designed for internal communication between clients and management servers rather than being directly exposed to the public internet, though configuration could potentially allow wider access.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Fortra's Core Privileged Access Manager, specifically within its autoregistration service. This issue could allow a remote attacker to cause memory corruption, potentially impacting the integrity and availability of systems managed by this privileged access solution. The primary concern at this stage is to confirm if this specific service is exposed externally and if it is relevant to our environment.

Vulnerability in privileged access software.
Critical flaw could affect system integrity.
Confirm relevance and exposure in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted response to the autoregistration service over the network. This would cause a buffer overflow in the `boks_autoregisterd` component, leading to memory corruption and potentially allowing the attacker to gain control.

Network access to the autoregistration service.
Sending a malicious client response.
Memory corruption and potential system compromise.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in a Fortra Core Privileged Access Manager autoregistration service could allow a remote attacker to cause memory corruption. This may impact the availability and integrity of the service when responding to client requests.

Service availability and integrity.
Memory corruption during client response.
Service disruption or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Fortra's Core Privileged Access Manager's autoregistration service requires immediate attention from infrastructure and security teams. The first practical step is to identify all instances of the affected component, confirm its network accessibility and business criticality, and then locate the accountable system owner to plan remediation based on risk.

Infrastructure and security teams own the issue.
Verify autoregistration service exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fortra Core Privileged Access Manager?

It is a security solution designed to manage and secure administrative credentials and access rights across an organization's IT environment. The specific component mentioned, BoKS, is used for centralized identity and access management, helping administrators control who can reach sensitive systems. It acts as a gatekeeper, ensuring that privileged sessions are authenticated and tracked to maintain infrastructure security.

What does a stack-based buffer overflow mean for CVE-2026-12627?

This vulnerability is classified as CWE-121, which refers to a memory corruption issue. It happens when the software writes more data to a specific memory area, called the stack, than it can hold. Because the software fails to properly check the size of incoming data, the excess information can overwrite adjacent memory. In the context of this CVE, this flaw could allow an attacker to disrupt the service or potentially execute unauthorized commands.

How is this buffer overflow triggered in the autoregistration service?

The issue occurs when the `boks_autoregisterd` component processes a malformed or malicious response sent by a client over the network. The vulnerability is tied specifically to this communication flow. Importantly, the flaw is not triggered by standard, well-formed configuration commands; it requires the receipt of a specifically crafted data packet that exploits the service's inability to safely handle oversized inputs.

Is my environment at risk from this vulnerability?

According to Halo Surface Signal, this service is generally intended for internal communication between clients and management servers. While it is network-accessible, it is not typically designed to be reachable from the public internet. You should assess whether your specific network configuration has inadvertently exposed this autoregistration service to untrusted segments, as this increases the potential for unauthorized remote access.

What should I do first to address this security flaw?

Start by identifying all servers running the Fortra Core Privileged Access Manager where the `boks_autoregisterd` component is active. Once you have a list of instances, verify their current network visibility to determine if they are exposed to wider network segments. Finally, coordinate with the system owners to prioritize these assets for patching or network isolation to mitigate the risk until an official update is applied.

References

www.fortra.com/security/advisories/product-security/fi-2026-017

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.