Fortra published eight BoKS security advisories on October 1, 2026: three rated Critical, three High and two Medium. The flaws range from a remotely reachable memory-corruption issue in the autoregistration service to password-generation weaknesses and bugs that can interrupt services. Fortra’s October 2 release notes list fixes in BoKS server releases s-8.1.0.24 and s-9.0.0.7, but a government CERT notice gives a later 8.1 threshold, s-8.1.0.30. Administrators should confirm the correct package and fixed build for their installation with Fortra before treating any 8.1 release as safe.
Which BoKS vulnerabilities did Fortra disclose?
The October 1 advisories cover eight different issues across BoKS components. Ratings below are the CVSS v3.1 scores displayed in Fortra’s advisories; they indicate vulnerability severity, not measured organizational impact. Access requirements and likely consequences differ, so a Critical rating alone does not establish whether a particular BoKS deployment is exposed.
As an Amazon Associate I earn from qualifying purchases.
| Fortra advisory | CVE | Rating | Component and issue | Exposure described |
|---|---|---|---|---|
| FI-2026-012 | CVE-2026-79901 | Critical, 9.9 | boks_keytabmd can generate predictable Active Directory service-account passwords when BoKS keytab management is used. |
Requires the affected service principal, an estimate of when its password changed and suitable Kerberos ticket material. See the scope details below. |
| FI-2026-013 | CVE-2026-79900 | Medium, 6.5 | boks_ksllogsd can write beyond a heap allocation while processing an oversized recognized digest name. |
An authenticated KSL client must supply the input. |
| FI-2026-014 | CVE-2026-79899 | High, 6.5 | bccgethostcert creates predictable temporary files without a restrictive umask. |
A local user able to read BOKS_tmp may obtain CA secret or host private-key material. |
| FI-2026-015 | CVE-2026-79898 | Critical, 9.1 | CRL URL handling can allow shell command substitution by crlserver. |
An authenticated user authorized to add CRL URLs through BCC, WSI REST/SOAP or cacrl can cause commands to run as root on the BoKS Master. |
| FI-2026-016 | CVE-2026-79896 | High, 7.5 | boks_portmux can terminate when parsing a malformed TLS ClientHello. |
A remote unauthenticated attacker can send the malformed message; repeated requests may sustain the interruption. |
| FI-2026-017 | CVE-2026-12627 | Critical, 9.8 | boks_autoregisterd can suffer memory corruption while processing a client response. |
A remote attacker with network access to the service may trigger the flaw. |
| FI-2026-018 | CVE-2026-9864 | Medium, 4.8 | The adjoin utility may generate machine-account passwords with less entropy than intended during an AD join or password renewal. |
Predictability may matter to an attacker able to estimate when the password was generated. |
| FI-2026-019 | CVE-2026-14316 | High, 8.1 | boks_sshd formats a revoked-key failure reason into an undersized heap buffer. |
Fortra’s summary identifies the error-handling path; the advisory rating is High. |
Which critical issues should BoKS administrators prioritize?
Autoregistration: remote memory corruption
For CVE-2026-12627, the stated prerequisite is network access to boks_autoregisterd. Unlike the keytab password flaw, this advisory does not limit exposure to a named feature configuration beyond reachability of the service. Administrators should identify where the daemon is enabled and which networks or hosts can connect to it, then confirm and apply the applicable fixed package with Fortra.
Recommended Free Tools
CRL handling: authorized input can reach a root process
CVE-2026-79898 concerns CRL URLs added through BCC, WSI REST/SOAP or cacrl. The required access is authenticated and authorized to add those URLs, but the command substitution is processed by crlserver as root on the BoKS Master. Review who holds that permission and whether these interfaces are reachable, and prioritize remediation where the capability is in use or exposed.
#1 Best Overall
AD service-account passwords: conditional keytab-management exposure
CVE-2026-79901 applies to deployments using BoKS keytab management, where boks_keytabmd generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. Fortra says exploitation requires knowledge of the affected service principal, an estimate of the password-change time and suitable Kerberos ticket material. Deployments that do not use keytab management are not affected by this issue; neither are administrator-supplied initial passwords.
Is the BoKS autoregistration service affected by another vulnerability?
Yes. The October stack overflow/memory-corruption advisory, FI-2026-017 (CVE-2026-12627), is separate from Fortra’s June 2026 advisory FI-2026-007 (CVE-2026-9862), which described OS command injection in boks_autoregisterd. The June advisory recommended restricting access to the service on its default port 6507 until fixed builds are deployed and described disabling the service as a workaround. Do not treat a mitigation or fix for one CVE as evidence that the other is resolved; confirm the status of both with Fortra.
Which BoKS versions are affected, and what version fixes them?
Fortra’s October 2, 2026 BoKS Manager release notes identify server releases s-8.1.0.24 and s-9.0.0.7 and list fixes for several of the October issues. The 8.1 notes name fixes for the KSL checksum issue, CRL command-injection protection, malformed TLS ClientHello crash and autoregistration proxy version overflow; the 9.0 notes list corresponding fixes.
There is an unresolved conflict specifically over the 8.1 threshold. The CSIRT Toscana / csirt.gov.it notice dated October 2 says 8.1.0.x versions before 8.1.0.30, 9.0.0.x versions before 9.0.0.7 and 10.1.0.x versions before 10.1.1.0 are affected. Fortra’s release notes instead identify server s-8.1.0.24. The available notices do not explain the difference, so neither 8.1.0.24 nor 8.1.0.30 should be presented as a universally confirmed 8.1 safe-version threshold.
The release-note versions refer to server packages; they do not establish that one server package alone resolves every Server Agent condition. Ask Fortra Support to confirm the fixed package for the installed server and agents, the applicable maintenance line and the status of each advisory. The notices do not establish a universal installation sequence.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do I need to update BoKS Manager?
Check your BoKS version, enabled components, network reachability and use of keytab management against the eight advisories, then obtain Fortra’s confirmation of the applicable fixed server and agent packages. Give particular attention to network access to boks_autoregisterd and to accounts or interfaces permitted to add CRL URLs on the BoKS Master. The CVSS ratings help compare severity, but actual exposure also depends on those deployment details.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
