Fortra Patches Critical Vulnerabilities in BoKS

Fortra released patches for eight vulnerabilities in Core Privileged Access Manager (BoKS), including three critical-severity bugs. One critical flaw, tracked as CVE-2026-79901 (CVSS 9.9), affects BoKS Manager deployments relying on the keytab for Active Directory service account management, potentially allowing authentication bypass by enabling offline password verification using predictable sequences seeded by Unix timestamps. A second critical bug, CVE-2026-79898 (CVSS 9.1), is a command injection defect in crlserver allowing authenticated users to substitute shell commands processed as root on the BoKS Master via BCC or WSI APIs. Additionally, a stack buffer overflow in autoregistration functionality (CVE-2026-12627, CVSS 9.8) and five other high- and medium-severity flaws involving heap buffer overflows, out-of-bounds reads, insecure temporary files, and predictable password generation were also addressed by Fortra.

The narrative centers on the security posture of privileged access management systems where cryptographic integrity and command execution are compromised. The exploitation of CVE-2026-79901 demonstrates a systemic failure in password entropy, linking high-level system operations (AD service accounts) directly to low-entropy, time-based randomness, which undermines foundational trust mechanisms like Kerberos. This moves the attack surface from requiring privileged access to exploiting temporal knowledge of session states. The command injection flaw (CVE-2026-79898) shows that even authenticated network interaction protocols (BCC/WSI) can bypass privilege separation controls on critical master components, suggesting trust boundaries enforced by software are brittle when operating over the network. The pattern observed is a focus on systemic weaknesses in key management and API security within infrastructure tooling, where predictability and access control fail simultaneously across different layers. This structure suggests that mitigating risk requires not just patching individual flaws but re-evaluating the assumptions about temporal security and least-privilege enforcement within complex enterprise management systems. What are the implicit assumptions built into current privileged access workflows that allow for the successful exploitation of time-based secrets? How do organizations reconcile the operational necessity of automated service account management with the requirement for true cryptographic unpredictability?