Fortra Patches Predictable RNG Flaw in BoKS AD Keytab Integration

The update addresses eight vulnerabilities across BoKS deployments managing Unix and Linux fleets. CVE-2026-79901 requires an attacker to estimate password change timing and possess service ticket material; standard authenticated AD accounts can request tickets without local admin rights on the BoKS host. Two additional critical issues include command injection in crlserver (CVE-2026-79898, CVSS 9.1) via BCC or WSI APIs and a stack buffer overflow in autoregistration (CVE-2026-12627, CVSS 9.8).

No public evidence shows in-the-wild exploitation of these CVEs. Fortra's advisory notes that exploitation of the RNG flaw demands specific preconditions around timing and ticket capture, distinguishing it from remote unauthenticated attacks. Five other high and medium issues involve heap overflows, out-of-bounds reads, and insecure temporary files.

This pattern recurs in PAM tools handling cross-platform identity: weak entropy in service account generation creates offline attack surfaces once Kerberos material leaks. Similar timestamp-seeded issues appeared in earlier AD bridge products, yet procurement records show continued reliance on BoKS for centralized Unix policy enforcement without independent RNG audits.

Organizations using BoKS with AD integration should apply patches immediately and rotate affected keytabs. Next steps include reviewing WSI API exposure and monitoring for similar entropy weaknesses in other privileged access products.