{"id":"CVE-2026-79898","published":"2026-10-01T15:17:31Z","modified":"2026-10-01T20:34:26Z","title":"Fortra BoKS Manager contains a command injection vulnerability in crlserver","vendor":"Fortra","product":"BoKS Manager","tier":"core","eol":null,"description":{"text":"Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.","provenance":"source","from":"NVD"},"summary":{"text":"Fortra BoKS Manager has a command injection flaw in its crlserver component, which processes shell command substitution in CRL URL input. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface can cause that substitution to run as root on the BoKS Master, and network access to BCC or WSI is sufficient, while non-root use of cacrl additionally requires a local sudo or suexec rule.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:57Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00995,"percentile":0.62621,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac7b19da11e545ded10ae9b","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac65e541c36819c31053833","created":"2026-10-07"},{"name":"Known_Cve | Oct 7, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac50f7dfc0547b9e8e2e5df","created":"2026-10-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2026-015","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-90875","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90875","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79898","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.52,"detail":"percentile 0.6262"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}