{"id":"CVE-2026-79898","published":"2026-10-01T14:57:28Z","modified":"2026-10-01T15:28:05Z","title":"Fortra BoKS Manager crlserver command injection vulnerability","vendor":"Fortra","product":"BoKS Manager","tier":"tail","description":{"text":"Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00995,"percentile":0.62664,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2026-015","tags":[]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":12.53},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"fortra","affectedVersions":[{"vendor":"Fortra","product":"BoKS Manager","versions":[">= 8.1.0.0, <= 8.1.0.23",">= 9.0.0.0, <= 9.0.0.6"]}],"euvd":{"id":"EUVD-2026-90875","exploited":false,"provenance":"source"}}