In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory…
Fortra · BoKS Manager boks-server
The flaw lies in the boks_keytabmd component of Fortra's BoKS Manager boks-server product, in deployments that use BoKS keytab management, where it generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate when the password was changed could reproduce a limited set of candidate passwords and verify them offline, and the attack requires no user interaction and only low-privileged authenticated access.
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 1 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 4 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Oct 10, 2026 | Part 1/29 Oct 2026
- Known_Cve | Oct 9, 2026 | Part 1/28 Oct 2026
- Known_Cve | Oct 8, 2026 | Part 1/27 Oct 2026
- Known_Cve | Oct 7, 2026 | Part 1/26 Oct 2026