Fortra released fixes for eight security flaws in its Core Privileged Access Manager (BoKS), including three critical bugs that could let attackers bypass authentication, run commands as root, or trigger memory corruption. The issues include CVE-2026-79901 in BoKS keytab Active Directory service account management, CVE-2026-79898 in crlserver reachable through BCC and the WSI REST or SOAP API, and CVE-2026-12627 in BoKS autoregistration; Fortra said it has no evidence of active exploitation.
Why it matters: Organizations using BoKS to control privileged access on Unix and Linux systems should treat this as urgent because compromise could hand attackers powerful access into core infrastructure. Admins should identify affected BoKS deployments and apply Fortra’s patches quickly, especially where Active Directory integration or network-accessible management interfaces are exposed.
Ionut Arghire
2026.10.03
100% relevant
This article appears to be the initial report of Fortra's October 2026 BoKS patch release covering CVE-2026-79901, CVE-2026-79898, CVE-2026-12627, and related vulnerabilities.
← Back to all stories