Fortra BoKS Manager: Insecure temporary file handling in bccgethostcert
Summary
Fortra BoKS Manager's bccgethostcert utility creates predictable temporary files without first setting a restrictive umask. A local user who can read files under BOKS_tmp on the BoKS Master may be able to obtain CA secret or host private-key material while the utility runs, or CA secret material left behind after successful certificate creation. The attacker needs an existing local account on the BoKS Master, and the record gives a CVSS score of 7.9 (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Affected
- BoKS Manager 8.1.0.0 to 8.1.0.23
- BoKS Manager 9.0.0.0 to 9.0.0.6
- Default configuration: unaffected according to the CVE record.
Fixed in
- Upgrade to boks-server 8.1.0.24
- Upgrade to boks-server 9.0.0.7
Workaround
- Until a fixed release is installed, restrict local access to the BoKS Master and BOKS_tmp.
- Run bccgethostcert with a restrictive umask such as 077.
- Securely remove stale bcccax.* or bcccreds.* files from BOKS_tmp.
Exploitation
- No public proof-of-concept found.
- No reports of active exploitation found.
- CISA SSVC assessment in the CVE record: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether the BoKS Master runs 8.1.x below 8.1.0.24 or 9.0.x below 9.0.0.7.
- If so, upgrade in the next maintenance window and restrict local access to the BoKS Master.
- If CA or host key material may have been exposed, consider rotating the host certificates.
- Patch remote BoKS issues from the same advisory batch first.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortra security advisory FI-2026-014 www.fortra.com
- OpenCVE entry CVE-2026-79899 app.opencve.io
- Strix CVE-2026-79899 entry www.strix.ai
- WindowsForum report on Fortra BoKS flaws windowsforum.com
- BoKS Manager release notes hstechdocs.helpsystems.com
- SecurityWeek: Fortra patches critical BoKS vulnerabilities www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:37.
Original description (NVD)
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.