# Fortra Patches Critical Vulnerabilities in BoKS Privileged Access Manager (CVE-2026-79901, CVE-2026-79898, CVE-2026-12627)

> Fortra patched three critical flaws in Core Privileged Access Manager (BoKS): predictable AD service-account password generation seeded by the Unix timestamp (CVSS 9.9), authenticated command injection in crlserver running as root (CVSS 9.1), and a remote unauthenticated stack buffer overflow in boks_autoregisterd (CVSS 9.8). Five further high/medium issues were also fixed. No in-the-wild exploitation was reported.

- **Published:** 2026-10-03T00:00:00Z
- **Last reviewed:** 2026-10-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2854
- **ID:** TL-2026-2854
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-79901, CVE-2026-79898, CVE-2026-12627, CVE-2026-9862

## Description

Fortra disclosed and patched multiple vulnerabilities in Core Privileged Access Manager (BoKS), the Unix/Linux privileged access and credential-vaulting platform. NVD published the three critical CVEs on 2026-10-01 (advisories FI-2026-012, FI-2026-015 and FI-2026-017) and SecurityWeek reported them on 2026-10-03. Because the BoKS Master is the trust anchor for privileged access across the managed Unix estate, compromise of the Master or of the service accounts it provisions has outsized blast radius.

CVE-2026-79901 (CVSS 9.9, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-338, advisory FI-2026-012): in deployments using BoKS keytab management, boks_keytabmd generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. SecurityWeek classes this as an authentication bypass and states exploitation requires knowledge of the service principal and an estimate of when the password was changed; an attacker with those inputs can narrow the candidate password space to a small set of timestamp seeds. NVD lists boks-server as affected from 0 up to (excluding) 9.0.0.6, with 9.0.0.6 onward unaffected.

CVE-2026-79898 (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, CWE-78, advisory FI-2026-015): crlserver processes shell command substitution supplied in a certificate revocation list (CRL) URL. An authenticated user authorized to add CRL URLs through the BoKS Control Center (BCC), the WSI REST or SOAP API, or the cacrl command-line interface can cause commands to run as root on the BoKS Master. Exposure through BCC and the WSI APIs means the attack is network-reachable and does not depend on local sudo/suexec rules. NVD lists BoKS Manager 8.1.0.0 through 8.1.0.23 and 9.0.0.0 through 9.0.0.6 as affected.

CVE-2026-12627 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-121, advisory FI-2026-017): a stack-based buffer overflow in boks_autoregisterd that remote, unauthenticated attackers with network access can trigger during client response processing, causing memory corruption. NVD lists BoKS 8.1.0.0 through 8.1.0.23 and 9.0.0.0 through 9.0.0.6 as affected.

Five additional high- and medium-severity flaws were fixed: two heap buffer overflows, an out-of-bounds read, insecure temporary file handling and a further predictable password generation issue. The sources do not give their CVE identifiers. SecurityWeek reports no exploitation in the wild and no public PoC is mentioned in any source; a lookup of the CISA KEV catalog did not surface these CVEs (the check was against a partial excerpt, so treat it as unconfirmed).

Context: this is not the first 2026 BoKS disclosure. Fortra advisory FI-2026-007 (identified 2026-05-27, disclosed 2026-06-15) covered CVE-2026-9862, an unauthenticated OS command injection (CVSS 9.8) in the same boks_autoregisterd service, and CVE-2026-9863, command injection in the legacy tar-based client upgrade tooling. Repeated critical findings in boks_autoregisterd mean that exposure of that service deserves priority regardless of patch level.

The Fortra advisory pages returned HTTP 403 to the collector, so fixed release numbers are not confirmed here; defenders should take them from the Fortra advisories. Because NVD marks 9.0.0.6 as affected for CVE-2026-79898 and CVE-2026-12627 but unaffected for CVE-2026-79901, the fixed release for those two must be later than 9.0.0.6.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1110.002 Password Cracking
- T1078.002 Domain Accounts

## Sources

- [SecurityWeek: Fortra Patches Critical Vulnerabilities in BoKS](https://www.securityweek.com/fortra-patches-critical-vulnerabilities-in-boks/)
- [Fortra Product Security Advisories](https://www.fortra.com/security/advisories/product-security)
- [Fortra FI-2026-012 (CVE-2026-79901)](https://www.fortra.com/security/advisories/product-security/fi-2026-012)
- [Fortra FI-2026-015 (CVE-2026-79898)](https://www.fortra.com/security/advisories/product-security/fi-2026-015)
- [Fortra FI-2026-017 (CVE-2026-12627)](https://www.fortra.com/security/advisories/product-security/fi-2026-017)
- [NVD CVE-2026-79901](https://nvd.nist.gov/vuln/detail/CVE-2026-79901)
- [NVD CVE-2026-79898](https://nvd.nist.gov/vuln/detail/CVE-2026-79898)
- [NVD CVE-2026-12627](https://nvd.nist.gov/vuln/detail/CVE-2026-12627)
- [NVD API record CVE-2026-79901](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-79901)
- [NVD CVE-2026-9862 (prior BoKS boks_autoregisterd command injection, FI-2026-007)](https://nvd.nist.gov/vuln/detail/CVE-2026-9862)
- [SentinelOne Vulnerability DB: CVE-2026-9863 (BoKS legacy tar client upgrade command injection)](https://www.sentinelone.com/vulnerability-database/cve-2026-9863/)
- [Rankiteo: Fortra BoKS command injection, June 2026](https://blog.rankiteo.com/for1781699072-fortra-vulnerability-june-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2854