The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Start by matching the vulnerability to the BoKS component and feature in use, then obtain the release-specific package and procedure from Fortra’s authenticated customer channel or support. For CVE-2026-79900, Fortra specifies boks-server 8.1.0.24 or 9.0.0.7, according to the installed maintenance line, and requires the updated boks_ksllogsd to be running. Those versions do not apply to the other advisories.
Identify the advisory that applies to your BoKS deployment
Fortra’s security index lists eight BoKS advisories dated October 1, 2026, FI-2026-012 through FI-2026-019. They affect different components and have different attack conditions; the group does not share one confirmed fixed build. Check each notice against the features and services enabled in your environment before planning a change.
As an Amazon Associate I earn from qualifying purchases.
| Advisory and CVE | Affected component or condition | Fortra severity and CVSS | Fixed release established in the reviewed notice |
|---|---|---|---|
| FI-2026-012 / CVE-2026-79901 | BoKS keytab management for Active Directory service-account passwords. Fortra says deployments not using this feature, or using administrator-supplied initial passwords, do not use the affected password-generation path. | Critical, 9.9 | Not stated |
| FI-2026-013 / CVE-2026-79900 | boks_ksllogsd checksum initialization: an authenticated KSL client can submit an oversized recognized digest name and trigger a heap write beyond the allocation. |
Medium, 6.5 | boks-server 8.1.0.24 or 9.0.0.7, depending on the installed maintenance line |
| FI-2026-014 / CVE-2026-79899 | bccgethostcert temporary files: a local user able to read files under BOKS_tmp may obtain CA secret or host private-key material from predictable files. |
Not stated | Not stated |
| FI-2026-015 / CVE-2026-79898 | crlserver command injection: an authenticated user authorized to add CRL URLs through BCC, WSI REST/SOAP, or cacrl can cause command substitution to run as root on the BoKS Master. |
Critical, 9.1 | Not stated |
| FI-2026-016 / CVE-2026-79896 | boks_portmux TLS parser: a remote unauthenticated party can send a malformed ClientHello to terminate the service; repeated requests may sustain an interruption. |
High, 7.5 | Not stated |
| FI-2026-017 / CVE-2026-12627 | boks_autoregisterd stack overflow; the described attack requires remote network access to the autoregistration service. |
Critical, 9.8 | Not stated |
| FI-2026-018 / CVE-2026-9864 | BoKS Server Agent generates low-entropy machine-account passwords during Active Directory join or renewal. | Medium, 4.8 | Not stated |
| FI-2026-019 / CVE-2026-14316 | boks_sshd revoked-key error path: a heap-buffer overflow occurs while building the failure message. |
High, 8.1 | Not stated |
“Not stated” means the reviewed public notice does not establish a release for that issue; it is not evidence that no fix exists. Request the current remediation guidance from Fortra for the affected maintenance line rather than assuming that the CVE-2026-79900 builds resolve a different component.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPlan the change without guessing at BoKS commands or packages
The public notices reviewed here do not give a universal install command, package filename, backup sequence, upgrade order, downtime expectation, or rollback procedure. Use the authenticated Fortra customer documentation or support to get the package and steps for your exact release and platform. Treat the following as an operational change framework, not as a vendor-published installation recipe.
#1 Best Overall
- Map the installation. Record BoKS Server and Server Agent versions, maintenance line, platform, Master/replica topology, and the affected feature or service. For FI-2026-012, specifically determine whether BoKS keytab management is used for AD service accounts.
- Match the fix to the advisory. Ask Fortra for the fixed build and release-specific procedure for the precise CVE and installed maintenance line. Do not infer a fix for an advisory whose public notice does not state one, or reuse FI-2026-013’s versions for another issue.
- Prepare the controlled change. Follow your organization’s BoKS change controls and tested rollback plan. Confirm the maintenance window, responsible operators, and expected service health checks using your supported local procedure.
- Apply the authorized package. Follow Fortra’s applicable instructions and your site’s approved sequence for the affected hosts. Do not improvise package names, commands, or Master/replica ordering from the vulnerability notice.
- Check operation and preserve evidence. Record the installed build, the service-health results, and any vendor instructions or support case with the change record. A successful restart alone does not prove that a vulnerability is remediated.
Verify CVE-2026-79900 at both the release and process level
For FI-2026-013, Fortra’s remediation is to upgrade to boks-server 8.1.0.24 or boks-server 9.0.0.7, as appropriate for the installed maintenance line, and ensure the updated boks_ksllogsd is running. Treat these as two parts of one verification: the installed release must be the applicable fixed build, and the active daemon must be the updated process.
Record the package or build identifier using the locally supported BoKS administration method, then inspect the running service through that same supported method. The advisory does not provide a command, so do not rely on an assumed process or package filename. Also check service health, client-to-Master communication, authentication and access paths, and logs against your normal BoKS baseline. Those operational checks can show that the system is functioning after the change; they are not independent proof of a particular CVE fix.
Account for the separate risk in legacy tar-based client patching
FI-2026-008 concerns command injection in the upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised client selected for upgrade or patching may cause commands to run on the BoKS Master during version handling. Until fixed tooling is deployed, Fortra’s stated workaround is to perform these operations only against trusted clients and avoid untrusted or potentially compromised clients. This warning is specific to the legacy tar-based client workflow; it is not a general prohibition on BoKS patching.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prioritize by exposure and impact, not score alone
Use Fortra’s CVSS ratings as context alongside the deployment-specific facts. First determine whether the affected component or feature is present; then assess reachability and the authentication or privilege prerequisites. Weigh the potential impact—such as root command execution, exposure of credential or key material, or service interruption—and whether Fortra has published a fixed build for that exact issue. Finally, check whether the planned work uses the legacy tar-based client workflow described above. This produces a more useful patch order than ranking scores without considering how your BoKS environment is configured.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
