Fortra patches critical BoKS flaws enabling AD bypass

Fortra released patches for eight vulnerabilities in its Core Privileged Access Manager (BoKS). Three of the flaws were rated critical. BoKS is used to manage Unix and Linux accounts and enforce access policies across systems.

Fortra warned that deployments using BoKS keytabs for Active Directory service account management are affected by a critical authentication bypass tracked as CVE-2026-79901 (CVSS 9.9). The vendor attributed the issue to AD service account passwords being generated from a predictable pseudo-random sequence seeded with the current Unix timestamp. An actor who knows the service principal and can estimate when the password changed can reproduce a limited set of candidate passwords and verify them offline if they have suitable Kerberos ticket material.

Fortra noted that exploiting CVE-2026-79901 does not normally require administrative access to BoKS, the service host or its keytab. A standard authenticated Active Directory account can request a service ticket for a service principal name assigned to the affected account, and a previously captured service ticket can provide the offline verification material needed to confirm candidate passwords.

The vendor also fixed a command injection vulnerability in the crlserver component, CVE-2026-79898 (CVSS 9.1). An authenticated user could substitute shell commands that would be executed as root on the BoKS Master. Fortra said the defect is exploitable through the BCC and WSI REST or SOAP APIs, both of which can be accessed over the network without local sudo or suexec rules.

A third critical fix, CVE-2026-12627 (CVSS 9.8), addresses a stack buffer overflow in BoKS’s autoregistration functionality that could allow a remote attacker to trigger memory corruption. Alongside the three critical issues, Fortra patched five additional high- and medium-severity flaws, including heap buffer overflows, an out-of-bounds read, an insecure temporary file vulnerability and another predictable password-generation issue.

Fortra reported no confirmed exploitation of these vulnerabilities to date. The vendor published technical details and updates on its product security page and supplied fixes for affected releases. Customers operating BoKS Manager, particularly those using BoKS keytabs for Active Directory service accounts or exposing BCC and WSI interfaces, were identified as most likely to be affected.