Summary
- Fortra published eight BoKS security advisories on 1 October.
- Critical issues include predictable Active Directory service account passwords and authenticated command injection.
- Exploitation conditions differ significantly between the vulnerabilities, and no active exploitation has been reported.
Fortra has disclosed eight vulnerabilities affecting its BoKS privileged access software, including critical weaknesses involving Active Directory service account passwords, command execution on the BoKS Master, and memory safety.
BoKS manages access and security policy across Unix and Linux environments, placing the affected software close to privileged identities and administrative functions that organisations use to restrict powerful accounts.
The highest rated issue, CVE-2026-79901, affects deployments using BoKS keytab management for Active Directory service accounts. Fortra says vulnerable versions generate some passwords from a predictable pseudo random sequence seeded with the current Unix timestamp.
Where an attacker knows the affected service principal, can estimate when the password changed, and possesses suitable Kerberos ticket material, a limited set of password candidates can be recreated and checked offline. Fortra assigns a CVSS score of 9.9, although those prerequisites mean the weakness does not apply universally to every BoKS installation.
Administrative permissions can lead to root commands
A second critical vulnerability, CVE-2026-79898, affects the crlserver component and can allow an authenticated user authorised to add certificate revocation list URLs to supply input that is processed as a shell command running as root on the BoKS Master.
BCC and the WSI REST or SOAP interfaces provide network accessible administration paths for the affected function, but exploitation still requires an authenticated account with the relevant privilege, separating the issue from an unauthenticated remote command execution flaw.
Fortra published six additional BoKS advisories on the same day, bringing the total to eight and covering further memory handling, temporary file, and password generation weaknesses across the privileged access platform.
Because the vulnerabilities affect different components and depend on different configurations, authentication states, and permissions, a single severity label does not describe exposure accurately across all installations.
The combination nevertheless reaches several controls that privileged access software is designed to protect, including credential strength, authorised administration, root level execution, and the reliability of software operating close to sensitive accounts.
Fortra published the eight advisories on 1 October, while neither its disclosures nor the current evidence reviewed for this article indicates that the vulnerabilities are being exploited in the wild.
