Fortra BoKS: Heap buffer overflow in boks_sshd revoked-key error handling
Summary
Fortra Core Privileged Access Manager (BoKS) contains a heap buffer overflow in the boks_sshd SSH component. The revoked-key error path formats a failure message with sprintf() into a heap buffer that is too small, so an attacker can write beyond the allocated memory. The flaw is only reachable when RevokedKeys is configured and public-key authentication checks a revoked key or hits an error reading the revoked-keys file; the CVSS rating is 8.1 (High).
Affected
- Core Privileged Access Manager (BoKS) 8.1.0.0 to before 8.1.0.30
- Core Privileged Access Manager (BoKS) 10.1.0.0 to before 10.1.1.0
- Default configuration: unknown
Fixed in
- 8.1 branch: Client c-8.1.0.30 (per vendor release notes)
- 10.1 branch: Unknown. Confirm the fixed build with Fortra.
Workaround
Unknown. No workaround was found in the sources; the vendor lists upgrading as the remediation.
Exploitation
- CISA SSVC: exploitation none, not automatable
- Not listed in CISA KEV
- No public proof-of-concept found; treat as unknown rather than confirmed absent
Our recommendation
- Inventory all BoKS installations (server and client, 8.1 and 10.1 branches)
- Upgrade to the fixed builds per Fortra advisory FI-2026-019, prioritising the critical items in the same release
- Confirm the 10.1 fixed build with Fortra
- Restrict SSH access to BoKS hosts to management networks and never expose boks_sshd to the internet
- Review whether RevokedKeys is configured on affected hosts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortra Security Advisory FI-2026-019 www.fortra.com
- BoKS Manager Release Notes hstechdocs.helpsystems.com
- OpenCVE CVE-2026-14316 app.opencve.io
- Strix CVE-2026-14316 www.strix.ai
- SecurityWeek: Fortra patches critical vulnerabilities in BoKS www.securityweek.com
- Fortra Product Security Advisories www.fortra.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:01.
Original description (NVD)
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.