Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

BoKS Manager creates predictable service‑account passwords

CVE-2026-79901 · published 18 days ago
Summary

The BoKS Manager server component can produce passwords for Active Directory service accounts using a method that can be guessed if the time of password change is known. This makes it possible for an attacker to try a small list of passwords offline and potentially gain access. Update to a fixed version or change the password generation method as soon as possible.

What to do
  • Update fortra boks manager boks-server to version 9.0.0.6 or later.
Affected software
VendorProductAffected versions
fortra boks manager boks-server < 9.0.0.6
Original advisory text
Predictable Active Directory service-account passwords in BoKS Manager
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-79901 · NVD
CVE-2026-79901 · MITRE
Track software like this
Free during beta