CVE-2026-9864 - Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

Back Back to CVE browser

MEDIUM

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

Published Oct 1, 2026

4.8

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

Affected products

Vendor Fortra Product Core Privileged Access Manager (BoKS) Default
unknown
Affected
- ≥ 8.1.0.0, ≤ 8.1.0.29
- ≥ 9.0.0.0, ≤ 9.0.0.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Fortra	Core Privileged Access Manager (BoKS)	unknown	Affected ≥ 8.1.0.0, ≤ 8.1.0.29 ≥ 9.0.0.0, ≤ 9.0.0.5

Remediation

Vendor solution

Upgrade to a fixed boks-client release newer than 8.1.0.29 or 9.0.0.5, then rotate machine-account passwords generated by affected versions.

Weaknesses (1)

CWE-338

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90889		Advisory
https://www.fortra.com/security/advisories/product-security/fi-2026-018

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Fortra

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved May 28, 2026

Link CVE-2026-9864

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-9864

Red Hat

No data

ENISA EUVD

Assigner Fortra

Published Oct 1, 2026

Updated Oct 1, 2026

Link EUVD-2026-90889

GitHub

No data