Fortra's advisory index lists the BoKS entries under Core Privileged Access Manager (BoKS). The advisories are FI-2026-012 through FI-2026-019, and all are dated October 1, 2026. The Canadian Centre for Cyber Security issued a matching notice, AV26-987, dated the same day. SecurityWeek reported on October 3 that Fortra had released patches for all eight flaws. It also said Fortra made no mention of exploitation in the wild.
Why a Unix tool matters to Windows shops
SecurityWeek describes BoKS as central management of Unix and Linux fleets, with policy enforcement and access control across accounts. Two of the flaws touch Active Directory directly: predictable service-account passwords, and weak machine-account passwords created when a host joins AD. A weakness in a tool that mints credentials for AD objects can spill into the wider domain.
The three critical flaws
CVE-2026-79901 (CVSS 9.9, FI-2026-012): predictable AD service-account passwords.
- In deployments using BoKS keytab management, the
boks_keytabmdcomponent generates AD service-account passwords from a predictable pseudo-random sequence. The seed is the current Unix timestamp. - An attacker who knows the service principal and can estimate when the password changed can reproduce a limited set of candidates and check them offline.
- Fortra says a standard authenticated AD account can ordinarily request a service ticket for an SPN assigned to the affected account. Administrative access to BoKS, the service host or its keytab is not normally required. A previously captured service ticket can also serve as offline verification material.
- This is essentially a Kerberoasting-style scenario with a much smaller search space. Fortra scopes it narrowly: only deployments using BoKS keytab management for AD service accounts are affected. Administrator-supplied initial passwords don't go through the vulnerable code path.
CVE-2026-79898 (CVSS 9.1, FI-2026-015): crlserver command injection.
- An authenticated user who can add CRL URLs could get shell command substitution processed as root on the BoKS Master. The paths are BCC, the WSI REST or SOAP API, and the
cacrlcommand-line interface. - SecurityWeek reports that BCC and WSI are reachable over the network and need no local sudo or suexec rule.
- The submitted research cites NVD as listing affected versions of 8.1.0.0 through 8.1.0.23 and 9.0.0.0 through 9.0.0.6. I could not independently retrieve that NVD page, so check it yourself.
CVE-2026-12627 (CVSS 9.8, FI-2026-017): boks_autoregisterd stack overflow.
- Fortra's vector is AV:N/AC:L/PR:N/UI:N, meaning network-reachable with no privileges or user interaction.
- A remote attacker with network access to the autoregistration service may trigger memory corruption while the daemon processes a client response. Fortra documents memory corruption, not confirmed code execution.
- This is the third autoregistration-service bug of the year. A June advisory covered a command injection in the same
boks_autoregisterdservice. That one advised restricting network access to the service, which listens on port 6507 by default. Treat the service as a recurring exposure point.
The five other advisories
| Advisory | CVE | Severity | Issue |
|---|---|---|---|
| FI-2026-016 | CVE-2026-79896 | High, 7.5 | Out-of-bounds read in the TLS ClientHello parser used by boks_portmux. A malformed message can kill the daemon without authentication. It normally restarts, but repeated requests can sustain an outage. |
| FI-2026-019 | CVE-2026-14316 | High, 8.1 | Heap overflow in the boks_sshd revoked-key error path. A sprintf() call writes into a heap buffer that is too small. |
| FI-2026-014 | CVE-2026-79899 | High, 6.5 | bccgethostcert creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may obtain CA secret or host private-key material. |
| FI-2026-018 | CVE-2026-9864 | Medium, 4.8 | adjoin may generate machine-account passwords with less entropy than intended during AD join or renewal. |
| FI-2026-013 | CVE-2026-79900 | Moderate | Heap overflow in KSL checksum initialization. |
One labeling quirk: Fortra rates CVE-2026-79899 "High" even though its CVSS score of 6.5 is in the numeric medium band. Go by Fortra's own severity label and the local-access requirement when you triage it.
Which versions are fixed
Fortra's advisory pages don't give one clean fixed-version table, so build numbers are the main source of confusion. Two sources give thresholds.
- The Canadian Centre for Cyber Security lists BoKS Manager boks-server as affected before 8.1.0.24 and before 9.0.0.7.
- A third-party technical write-up says Fortra's CNA records address multiple Manager CVEs in boks-server 8.1.0.24 and 9.0.0.7. It also gives affected ranges for the adjoin issue on the server agent: 8.1.0.0 through 8.1.0.29, and 9.0.0.0 through 9.0.0.5.
- The submitted research also cites the Canadian notice as listing other thresholds for the Core Privileged Access Manager label: before 10.1.1.0, 9.0.0.7 and 8.1.0.30. I did not confirm that list independently.
Several components and branches are involved, with separate server and agent builds. Don't assume one build number covers everything. Confirm the target release and upgrade path with Fortra support.
What to do now
- Inventory. Record each BoKS Master and replica by product line, branch and exact build, and do the same for server agents.
- Check for keytab management. Find out whether BoKS generates AD service-account passwords in your environment. If it does, plan to patch and then rotate those passwords after the fix, since existing passwords were generated by the weak code path. That rotation step is my own reasoning, not a Fortra instruction. Check Fortra's guidance on it.
- Limit CRL permissions. Remove the ability to add CRL URLs from anyone who doesn't need it. Restrict network access to BCC and WSI.
- Segment the autoregistration service. Allow only trusted hosts to reach
boks_autoregisterd, and checkboks_portmuxexposure too. - Review local access on the Master for the certificate temporary-file issue.
- Patch, then test. Confirm the version and that authentication and registration still work.
Network restrictions reduce exposure but don't replace the vendor fixes.
The bottom line
Fortra says nothing about exploitation, but that only reflects the vendor's reporting. Privileged access managers are high-value targets, and several of these bugs are reachable over the network. The unclear fixed-version picture is the real operational headache. Verify your exact builds rather than trusting a generic "updated" status.