CVE-2026-79901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-79901", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-08-25T14:50:15.178Z", "datePublished": "2026-10-01T13:52:27.046Z", "dateUpdated": "2026-10-01T14:43:07.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-10-01T13:52:27.046Z"}, "title": "Predictable Active Directory service-account passwords in BoKS Manager", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-338", "description": "CWE-338 Use of cryptographically weak Pseudo-Random number generator (PRNG)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "affected": [{"vendor": "Fortra", "product": "BoKS Manager boks-server", "versions": [{"status": "affected", "version": "0", "lessThan": "9.0.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline."}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-012"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "configurations": [{"lang": "en", "value": "Only BoKS Manager deployments using BoKS keytab management to manage Active Directory service accounts are affected. Deployments that do not use BoKS keytab management are not affected. Administrator-supplied initial service-account passwords are not generated through the vulnerable code path and are not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Only BoKS Manager deployments using BoKS keytab management to manage Active Directory service accounts are affected. Deployments that do not use BoKS keytab management are not affected. Administrator-supplied initial service-account passwords are not generated through the vulnerable code path and are not affected."}]}, {"lang": "en", "value": "Exploitation requires knowledge of the affected service principal, an estimate of the password-change time, and suitable Kerberos ticket material. A standard authenticated Active Directory account can ordinarily request a service ticket for an SPN assigned to the affected account; administrative access to BoKS, the service host, or its keytab is not normally required. A previously captured service ticket can alternatively provide offline verification material.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Exploitation requires knowledge of the affected service principal, an estimate of the password-change time, and suitable Kerberos ticket material. A standard authenticated Active Directory account can ordinarily request a service ticket for an SPN assigned to the affected account; administrative access to BoKS, the service host, or its keytab is not normally required. A previously captured service ticket can alternatively provide offline verification material."}]}], "workarounds": [{"lang": "en", "value": "Installing the update does not secure passwords generated by an affected release. Rotate all affected or uncertain service-account passwords through BoKS keytab management and confirm distribution of the new key version. After the Active Directory domain's configured maximum service-ticket lifetime plus clock-skew allowance has elapsed, rebuild affected keytabs during a maintenance window so they retain only the current key version. Redistribute and verify the keytabs, restart or reload dependent services as required, and test Kerberos authentication. If compromise is suspected, rotate and rebuild immediately rather than waiting for existing tickets to expire.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Installing the update does not secure passwords generated by an affected release. Rotate all affected or uncertain service-account passwords through BoKS keytab management and confirm distribution of the new key version. After the Active Directory domain's configured maximum service-ticket lifetime plus clock-skew allowance has elapsed, rebuild affected keytabs during a maintenance window so they retain only the current key version. Redistribute and verify the keytabs, restart or reload dependent services as required, and test Kerberos authentication. If compromise is suspected, rotate and rebuild immediately rather than waiting for existing tickets to expire."}]}], "solutions": [{"lang": "en", "value": "Upgrade the active BoKS Master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade the active BoKS Master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords."}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T14:42:41.970090Z", "id": "CVE-2026-79901", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:43:07.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-79901", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T14:42:41.970090Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:42:56.920Z"}}], "cna": {"title": "Predictable Active Directory service-account passwords in BoKS Manager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fortra", "product": "BoKS Manager boks-server", "versions": [{"status": "affected", "version": "0", "lessThan": "9.0.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade the active BoKS Master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords.", "supportingMedia": [{"type": "text/html", "value": "Upgrade the active BoKS Master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords.", "base64": false}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-012"}], "workarounds": [{"lang": "en", "value": "Installing the update does not secure passwords generated by an affected release. Rotate all affected or uncertain service-account passwords through BoKS keytab management and confirm distribution of the new key version. After the Active Directory domain's configured maximum service-ticket lifetime plus clock-skew allowance has elapsed, rebuild affected keytabs during a maintenance window so they retain only the current key version. Redistribute and verify the keytabs, restart or reload dependent services as required, and test Kerberos authentication. If compromise is suspected, rotate and rebuild immediately rather than waiting for existing tickets to expire.", "supportingMedia": [{"type": "text/html", "value": "Installing the update does not secure passwords generated by an affected release. Rotate all affected or uncertain service-account passwords through BoKS keytab management and confirm distribution of the new key version. After the Active Directory domain's configured maximum service-ticket lifetime plus clock-skew allowance has elapsed, rebuild affected keytabs during a maintenance window so they retain only the current key version. Redistribute and verify the keytabs, restart or reload dependent services as required, and test Kerberos authentication. If compromise is suspected, rotate and rebuild immediately rather than waiting for existing tickets to expire.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.", "supportingMedia": [{"type": "text/html", "value": "In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of cryptographically weak Pseudo-Random number generator (PRNG)"}]}], "configurations": [{"lang": "en", "value": "Only BoKS Manager deployments using BoKS keytab management to manage Active Directory service accounts are affected. Deployments that do not use BoKS keytab management are not affected. Administrator-supplied initial service-account passwords are not generated through the vulnerable code path and are not affected.", "supportingMedia": [{"type": "text/html", "value": "Only BoKS Manager deployments using BoKS keytab management to manage Active Directory service accounts are affected. Deployments that do not use BoKS keytab management are not affected. Administrator-supplied initial service-account passwords are not generated through the vulnerable code path and are not affected.", "base64": false}]}, {"lang": "en", "value": "Exploitation requires knowledge of the affected service principal, an estimate of the password-change time, and suitable Kerberos ticket material. A standard authenticated Active Directory account can ordinarily request a service ticket for an SPN assigned to the affected account; administrative access to BoKS, the service host, or its keytab is not normally required. A previously captured service ticket can alternatively provide offline verification material.", "supportingMedia": [{"type": "text/html", "value": "Exploitation requires knowledge of the affected service principal, an estimate of the password-change time, and suitable Kerberos ticket material. A standard authenticated Active Directory account can ordinarily request a service ticket for an SPN assigned to the affected account; administrative access to BoKS, the service host, or its keytab is not normally required. A previously captured service ticket can alternatively provide offline verification material.", "base64": false}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-10-01T13:52:27.046Z"}}}, "cveMetadata": {"cveId": "CVE-2026-79901", "state": "PUBLISHED", "dateUpdated": "2026-10-01T14:43:07.294Z", "dateReserved": "2026-08-25T14:50:15.178Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2026-10-01T13:52:27.046Z", "assignerShortName": "Fortra"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BoKS Manager boks-server", "vendor": "Fortra", "versions": [{"lessThan": "9.0.0.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline."}], "id": "CVE-2026-79901", "lastModified": "2026-10-01T15:17:32.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79901", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T14:42:41.970090Z", "version": "2.0.3"}}]}, "published": "2026-10-01T14:17:30.883", "references": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-012"}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.0.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BoKS Manager boks-server", "source": "cna", "vendor": "Fortra"}, "product": "boks_manager_boks-server", "vendor": "fortra"}], "created": "2026-10-01T16:15:10.909630+00:00", "updated": "2026-10-01T19:34:24.561594+00:00", "vendors": ["fortra", "fortra$PRODUCT$boks_manager_boks-server"]}