Fortra BoKS Manager: Predictable Active Directory service-account passwords

Summary

BoKS keytab management generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the Unix timestamp. An attacker with a domain account who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline. The CVSS base score is 9.9, but exposure is limited to deployments that use BoKS keytab management for AD service accounts.

Affected

• Fortra BoKS Manager boks-server below 9.0.0.6 according to the CNA record
• Only deployments that use BoKS keytab management to manage Active Directory service accounts
• Whether the 9.0.0.6 build is affected is unclear; verify the exact boundary in advisory FI-2026-012

Fixed in

• boks-server 9.0.0.7 according to the CNA record and the vendor's advisory summary
• Installing the update does not make passwords generated by an affected release secure

Workaround

• No workaround beyond patching is documented.
• Rotate all affected or uncertain service-account passwords through BoKS keytab management and confirm distribution of the new key version.
• After the domain's maximum service-ticket lifetime plus clock-skew allowance has elapsed, rebuild affected keytabs during a maintenance window so they keep only the current key version.
• If compromise is suspected, rotate and rebuild immediately.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No known exploitation in the wild at the time of research.
• No public proof of concept found in a limited search.
• Exploitation requires the service principal, an estimate of the password-change time and Kerberos ticket material; a standard authenticated AD account can ordinarily obtain service tickets.

Our recommendation

• Check whether BoKS keytab management generates AD service-account passwords in your environment.
• Upgrade the active BoKS master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords; confirm the exact fixed build in FI-2026-012.
• Rotate all affected service-account passwords and keytabs, then rebuild keytabs as described in the advisory and test Kerberos authentication.
• Review AD service accounts with SPNs and limit who can request service tickets for them.
• If the product is not in use, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fortra security advisory FI-2026-012 www.fortra.com
• SecurityWeek: Fortra patches critical vulnerabilities in BoKS www.securityweek.com
• OpenCVE: CVE-2026-79901 app.opencve.io
• Strix: CVE-2026-79901 www.strix.ai
• threatint: CVE-2026-79901 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:45.