Fortra Patches Critical Flaws in Core Privileged Access Manager (BoKS)

Enterprise identity and access controls faced a significant update this week after Fortra issued patches for eight vulnerabilities in its Core Privileged Access Manager (BoKS) platform. A Fortra BoKS vulnerability advisory highlights three critical-severity flaws—tracked as CVE-2026-79901, CVE-2026-79898, and CVE-2026-12627—that could enable unauthenticated or low-privileged network attackers to bypass authentication, execute commands as root on the master management server, or trigger remote memory corruption. Because BoKS functions as a central administration plane for policy enforcement and credential delegation across heterogeneous Unix and Linux enterprise fleets, security weaknesses in its central daemons present an exceptionally elevated risk profile.

Fortra reported no evidence of active zero-day exploitation prior to disclosure, but given the critical role privileged access management (PAM) appliances play in enterprise networks, administrators should prioritize updating affected installations immediately.

Critical Flaws: Auth Bypass, Command Injection, and Memory Corruption

The most severe defect in the bundle is CVE-2026-79901, which carries a CVSS score of 9.9. This vulnerability stems from a fundamental cryptographic flaw in how the BoKS Manager handles Active Directory (AD) service account management using the BoKS keytab. When automatically managing these service accounts, the system generates account passwords using a predictable pseudo-random number generator (PRNG) seeded directly with the current Unix timestamp.

Because Unix timestamps offer a very narrow entropy search space, any attacker who knows the target Service Principal Name (SPN) and can reasonably estimate when the password change event occurred can reproduce the entire set of candidate passwords offline. Obtaining verification material does not require administrative privileges within BoKS or host-level access to the keytab; standard authenticated Active Directory users can simply request a Kerberos service ticket (TGS-REP) for the target SPN over the network, or leverage previously captured service tickets to brute-force the weak password offline. Once cracked, the attacker gains full control over the service account, effecting a complete authentication bypass.

The second critical issue, CVE-2026-79898 (CVSS score 9.1), resides within the crlserver component of the BoKS Master server. It is a classic command injection vulnerability where untrusted input passed through the BoKS Command Control (BCC) interface or the Web Services Interface (WSI) REST/SOAP APIs is evaluated insecurely. An authenticated user capable of submitting requests to these network-accessible interfaces can inject arbitrary shell syntax, which the server processes with full root privileges. Because BCC and WSI endpoints are reachable over the network without requiring a local sudo or suexec rule on the local host, this flaw effectively turns low-privileged API connectivity into complete server compromise.

Rounding out the critical issues is CVE-2026-12627 (CVSS score 9.8), a stack-based buffer overflow in the BoKS host autoregistration listener. Autoregistration mechanisms typically run as pre-authentication network services to allow newly provisioned Linux endpoints to enroll into the BoKS cluster. By sending crafted, oversized network payloads during the registration handshake, a remote, unauthenticated attacker can overwrite stack memory, potentially leading to arbitrary code execution or a persistent denial-of-service condition on the management node.

In addition to the critical trio, Fortra resolved five medium- and high-severity vulnerabilities covering heap buffer overflows, out-of-bounds reads, insecure temporary file creation, and additional instances of predictable password generation.

Blast Radius and Architectural Impact

Privileged Access Management platforms occupy the highest layer of implicit trust within enterprise infrastructure. Solutions like Fortra Core Privileged Access Manager serve as the central source of truth for administrative credentials, system access policies, multi-factor authentication enforcement, and session monitoring across entire data center and cloud environments.

When an attacker achieves root execution on a BoKS Master (via CVE-2026-79898) or remote buffer exploitation (via CVE-2026-12627), the blast radius extends beyond the PAM cluster itself. A compromised PAM master grants the adversary access to local configuration files, cryptographic keys, database stores, and active administrative sessions. From this position, an attacker can extract domain keytabs, tamper with global access policies, push malicious configurations to managed Unix/Linux endpoints, or mint arbitrary administrative access credentials across all downstream servers.

Similarly, the Kerberos password predictability in CVE-2026-79901 provides an entry point that bridges standard Active Directory access with high-privilege Unix infrastructure. Because Kerberoasting-style offline cracking attacks rely standard protocol interactions, security operations centers (SOCs) monitoring network traffic may only observe routine Kerberos TGS requests, masking the offline cracking process until the compromised service account is actively misused.

Remediation and Risk Reduction

Fortra has published security patches addressing all eight vulnerabilities across supported release branches on its official product security portal. Organizations operating BoKS in Active Directory-integrated environments should execute the following steps:

1. Apply Software Updates: Upgrade BoKS Master nodes, BoKS Manager instances, and client components to the latest patched software versions published on Fortra’s support portal.
2. Rotate Active Directory Keytabs and Passwords: Following the update, immediately force a password reset and regenerate keytabs for all Active Directory service accounts managed by BoKS. Updating the software prevents future generation of timestamp-seeded passwords, but existing accounts created prior to the patch remain vulnerable to offline cracking if their credentials are not explicitly rotated.
3. Restrict Network Access: Limit exposure of the BoKS WSI REST/SOAP APIs, BCC interfaces, and host autoregistration ports using network firewalls or microsegmentation. Only authorized host ranges and trusted endpoints should be permitted to communicate with master daemons.
4. Monitor Kerberos Ticket Activity: Audit Active Directory event logs (specifically Event ID 4769) for unusual volumes of service ticket requests targeting BoKS-managed SPNs, particularly those originating from standard non-administrative user accounts.