CVE-2026-9864
Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
| CWE | CWE-338 |
| Vendor | fortra |
| Product | core privileged access manager (boks) |
| Published | Oct 1, 2026 |
| Last Updated | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for fortra core privileged access manager (boks)
Be the first to know when new medium vulnerabilities affecting fortra core privileged access manager (boks) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Fortra / Core Privileged Access Manager (BoKS)
8.1.0.0 ≤ 8.1.0.29 9.0.0.0 ≤ 9.0.0.5