Fortra has released fixes for eight vulnerabilities in Core Privileged Access Manager (BoKS), including three rated critical, SecurityWeek reported Saturday. The software centrally controls who can log in to and administer fleets of Unix and Linux servers.

What Happened

The most severe flaw, CVE-2026-79901, carries a CVSS score of 9.9. It is an authentication bypass affecting BoKS Manager deployments that use a keytab to manage Active Directory service accounts. According to SecurityWeek, the passwords for those service accounts are produced from a predictable pseudo-random sequence seeded with the current Unix timestamp.

Exploiting it is not trivial. An attacker would need to know the service principal, estimate when the password was last changed and have Kerberos ticket material or ordinary Active Directory account access. With those pieces, the timestamp seed narrows the possible passwords enough to make guessing feasible.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The second critical issue, CVE-2026-79898 with a CVSS score of 9.1, is a command injection bug in the crlserver component. It allows an authenticated user to substitute shell commands that then run as root on the BoKS Master, the central server in a BoKS deployment. SecurityWeek said the flaw can be reached over the network through the BCC and WSI REST or SOAP APIs without local privileges.

The third, CVE-2026-12627 with a CVSS score of 9.8, is a stack buffer overflow in the autoregistration feature that a remote attacker could use to trigger memory corruption, which can lead to code execution.

The remaining five fixes address high- and medium-severity problems: heap buffer overflows, an out-of-bounds read, insecure handling of temporary files and another case of predictable password generation. SecurityWeek reported no known exploitation of any of the flaws. Details are posted on Fortra's product security page.

Why It Matters

Privileged access management tools sit at the top of an organization's trust structure. BoKS decides which users can log in to which servers and what they can do once there, including access to root. An attacker who compromises the BoKS Master could potentially grant themselves broad access across every Unix and Linux system it manages.

That makes the command injection flaw particularly serious even though it requires authentication. Any valid account with API access could become a path to root on the central server. The timestamp-seeded passwords, meanwhile, reflect a basic cryptographic mistake: using the clock as a seed gives an attacker a small, searchable range of possibilities instead of truly random values.

The buffer overflow in autoregistration adds a different kind of risk, because SecurityWeek described it as reachable by a remote attacker, and memory corruption bugs of that type are a common route to running malicious code.

Context

Fortra products have been targeted before. Its GoAnywhere managed file transfer software was exploited in mass data theft campaigns by ransomware groups, which has made Fortra advisories a closely watched item for defenders. There is no indication that the BoKS flaws are linked to that history, but the earlier incidents showed how quickly attackers can move once details of enterprise software flaws become public.

What to Watch

Administrators running BoKS should apply Fortra's updated releases and review which accounts have access to the BCC and WSI APIs. Organizations that use keytab-managed Active Directory service accounts should consider rotating those passwords after patching.

Security teams will also watch for proof-of-concept exploit code and for any addition of the flaws to CISA's Known Exploited Vulnerabilities catalog, which would signal active attacks.