Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Check BoKS security by inventorying each Manager server, Server Agent/client and BoKS SSH installation, then matching its full package version to the current Fortra advisory for that component. As of October 4, 2026, Canada’s Cyber Centre identifies BoKS server versions below 8.1.0.24 and 9.0.0.7 as affected; those server thresholds do not establish whether agents or SSH packages are safe. A version check can identify exposure, but it cannot prove whether a system has been compromised.
What to check before deciding a BoKS system is vulnerable
BoKS is not one package with one version number. Assess each component separately: the BoKS Manager (Master and Replicas), Server Agents on managed hosts, and any separately packaged BoKS SSH component. Include legacy tar-based clients if present. Record the maintenance line as well as the complete package version; a server release number is not a substitute for an agent or SSH version.
As an Amazon Associate I earn from qualifying purchases.
Fortra’s security advisory list and BoKS release notes identify component-specific releases and fixes. The October 2, 2026 release notes list server builds s-8.1.0.24 and s-9.0.0.7, and client build c-8.1.0.30. The Canadian Centre for Cyber Security’s October 2026 alert says BoKS server versions earlier than 8.1.0.24 and 9.0.0.7 are affected. Match the threshold to the installed branch; do not treat 8.1 and 9.0 as interchangeable.
Run a component-by-component check
- Map the installation. List every Master, Replica and managed host, and note which have a Server Agent, separately packaged BoKS SSH, or legacy tar-based client. Identify servers running autoregistration and whether those services can be reached from untrusted or less-trusted networks.
- Collect exact installed versions. Check local package records or the organization’s deployment records on each relevant machine. Record the component, role, maintenance line and full version string. Verify the actual installed package rather than relying only on an upgrade plan or a central server’s version.
- Match each component to its advisory. Compare the server against the applicable branch threshold, then check client/agent and SSH packages against their own Fortra advisories and release notes. For a legacy installation or a package whose mapping is unclear, do not infer its status from the server version; confirm the applicable fixed build with Fortra or vendor support.
- Check affected services and binaries. On relevant systems, determine whether boks_autoregisterd, boks_portmux, boks_ksllogsd or boks_sshd is installed and running. Their presence and network reachability help prioritize remediation, but do not replace the version comparison or update.
- Apply the matching fix and verify it. Update every affected node, including Replicas and managed hosts where applicable. Recheck package versions and service state after deployment. For CVE-2026-79900, Fortra specifies boks-server 8.1.0.24 or 9.0.0.7 as appropriate and requires the updated boks_ksllogsd to be running.
Current BoKS issues to include in the assessment
The advisories below cover different components, prerequisites and remedies. Their CVSS v3.1 scores are published by Fortra in 2026; they describe severity, not the likelihood that a particular installation has been attacked.
#1 Best Overall
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
| Issue | Affected component and reported risk | Assessment or response |
|---|---|---|
| CVE-2026-12627 | boks_autoregisterd stack-based buffer overflow. Fortra rates it Critical, CVSS 9.8, and says a remote attacker with network access to the service may trigger memory corruption during client response processing. | Check the server build and whether the service is reachable. Compare against the matching Fortra advisory and fixed release. |
| CVE-2026-79896 | boks_portmux malformed TLS ClientHello out-of-bounds read. A remote unauthenticated attacker can terminate the service; repeated requests can sustain interruption. High, CVSS 7.5. | Check the relevant server and service, then use the component-specific Fortra advisory for the fixed build. |
| CVE-2026-79900 | boks_ksllogsd heap overflow when an authenticated KSL client supplies an oversized recognized digest name. Medium, CVSS 6.5. | Fortra specifies boks-server 8.1.0.24 or 9.0.0.7 as appropriate, with the updated boks_ksllogsd running. |
| CVE-2026-14316 | boks_sshd heap overflow in the revoked-key error path. High, CVSS 8.1. | Check BoKS SSH installations separately and follow the specific Fortra advisory; a Manager version alone does not determine SSH status. |
| CVE-2026-9862 | boks_autoregisterd command injection. A remote attacker with network access may execute commands with the service’s privileges during autoregistration. | Fortra’s June 15, 2026 advisory recommends restricting network access to boks_autoregisterd, which listens on port 6507 by default, until fixed builds are deployed. |
| CVE-2026-9863 | Legacy tar-based client upgrade/patch command injection: a malicious or compromised client selected for upgrade or patching may cause commands to execute on the BoKS Master during version handling. | Until fixed builds are deployed, Fortra says to perform these operations only against trusted clients. |
| CVE-2025-13532 | Weak password hashing in Server Agent 9.0 instances supporting yescrypt in an 8.1 domain. | Check both agent version and domain combination. Fortra recommends Server Agent 9.0.0.4. |
Use workarounds only for the issue they address
Restricting access to port 6507 is interim guidance for the CVE-2026-9862 autoregistration command-injection issue; it is not a general substitute for updates or a mitigation for every BoKS vulnerability. Likewise, the trusted-client restriction concerns legacy tar-based upgrade and patch operations associated with CVE-2026-9863. Apply the mitigation described in the relevant advisory while arranging the fixed build.
Check upgrade compatibility before deployment
Fortra warns that Server s-9.0.0.7 paired with Client c-9.0.0.6 can cause Entra ID authentication to fail or use a different permitted method. If Entra ID is in use, its release notes recommend waiting for Client c-9.0.0.7 and upgrading both components. Validate the planned server-client combination against the current release notes before rolling out an update.
Rank #2
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
What a version check can and cannot tell you
An affected version means the installation matches a vendor-published affected range; it does not show that an attacker reached the service or that exploitation occurred. A fixed version and verified service state establish that the specified update is active, but do not by themselves prove that a system was never compromised. Public advisories also cannot reveal what packages, daemons or network controls exist in your environment. If evidence of compromise is a concern, handle that as a separate incident-response investigation.
Advisory thresholds and releases can change. The versions and alerts cited here were current on October 4, 2026; consult Fortra’s latest component-specific advisories before making an update decision.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- FIDO2 Certified Passkey Authentication: Officially FIDO2 certified for secure, passwordless login on supported platforms. Use modern passkeys with hardware-backed protection. Please verify your intended service supports FIDO2 hardware keys before purchase.
- Precision Fingerprint Sensor: Built-in high-accuracy biometric fingerprint sensor ensures fast, convenient authentication while preventing unauthorized access. No PIN reuse, no shared secrets—only your fingerprint unlocks the key.
- Strong Hardware 2FA/MFA Security: Enhances account protection with physical-presence and biometric verification, helping defend against phishing, credential theft, and account takeovers.
- USB-C Wired Compatibility (No NFC): Designed for stable USB-C authentication on desktops and laptops, including Windows, macOS, and Linux systems. Ideal for users and enterprises that prefer wired-only security keys.
- Durable Aluminum Shield, Portable Design: Features the same precision aluminum protective shield for long-term durability. Compact, lightweight, battery-free, and network-free-built for everyday carry and professional environments.
Rank #3
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
