Fortra Patches Critical Vulnerabilities in BoKS

The core mechanism is a predictable pseudo-random sequence that seeds AD service account passwords with the current Unix timestamp in BoKS keytab deployments, tracked as CVE-2026-79901 at CVSS 9.9. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline using previously captured Kerberos service tickets; a standard authenticated Active Directory account can request a service ticket for the affected SPN without administrative access to BoKS, the service host, or the keytab. The second critical bug, CVE-2026-79898 at CVSS 9.1, is a command injection defect, while CVE-2026-9862 covers an additional command injection in BoKS Core PAM; the story carries four CVE identifiers (CVE-2026-12627, CVE-2026-79898, CVE-2026-79901, CVE-2026-9862) across eight patched vulnerabilities, three of them critical.

A successful authentication bypass gives an attacker privileged access to a privileged-access manager that enforces policy across Unix and Linux fleets, which means the compromise extends from a single service account to the entire managed host population. The event notes that an attacker needs only a standard AD account and suitable Kerberos ticket material, not elevated privileges inside BoKS, which lowers the barrier well below typical admin-level exploits and makes this story more urgent than routine patch-roundup noise. With a CVSS 9.9 and offline verification possible, the flaw favors targeted intrusion over mass scanning, so organizations using BoKS keytab for Active Directory service account management should treat it as an active-target risk rather than theoretical.

Defenders should apply Fortra's released patches immediately, rotate AD service account passwords for all BoKS keytab integrations, and restrict SPN service-ticket requests to expected principals. Hunt for previously captured Kerberos service tickets being replayed against affected SPNs, review keytab access logs, and inspect BoKS Manager logs for unexpected authentication events; the event text specifically references SPN assignment verification and offline verification material, so any sudden spike in Kerberos TGS-REQ traffic for BoKS service principals is a direct telemetry lead. Network restrictions on the Kerberos path and temporary suspension of predictable password rotation schedules reduce exposure until patches are confirmed deployed.

Watch for exploitation telemetry tied to CVE-2026-79901 specifically, since offline verification and predictable seeding create a reproducible attack path that defenders can model. Any vendor update expanding the affected version range for CVE-2026-79898 or CVE-2026-9862, or a public proof-of-concept confirming the timestamp-seed reproduction, would shift the assessment from high-risk patch urgency to confirmed active exploitation.