CVE-2026-9864
Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
- Published
- Updated
- Reserved
- Assigned by
- Fortra
Description
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| FortraCNA (assigner) | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
Affected products
Fortra · Core Privileged Access Manager (BoKS)
- affected 8.1.0.0 – ≤ 8.1.0.29
- affected 9.0.0.0 – ≤ 9.0.0.5
What to do
Solution: Upgrade to a fixed boks-client release newer than 8.1.0.29 or 9.0.0.5, then rotate machine-account passwords generated by affected versions.
Workaround: Until fixed builds are deployed, avoid running adjoin join or autoupdate operations from affected versions. If automatic machine-account password renewal is enabled, disable it temporarily or ensure renewed passwords are rotated again after upgrading to a fixed version.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-9864)Record last updated .