Vulnerabilidades do Fortra Core Privileged Access Manager (BoKS)

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Fortra Core Privileged Access Manager (BoKS): 5 registro(s), com versões afetadas e correções.

CVE-2026-14316 Alta · 8.1 CWE-122 01/10/2026

Heap buffer overflow in boks_sshd revoked-key error handling

The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.

CVE-2026-9864 Média · 4.8 CWE-338 01/10/2026

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

CVE-2026-9863 Alta · 8.8 CWE-78 15/06/2026

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

CVE-2026-9862 Crítica · 9.8 CWE-78 15/06/2026

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

CVE-2025-13532 Média · 6.2 CWE-916 16/12/2025

Weak Password Hash in Core Privileged Access Manager (BoKS)

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.