CVE-2026-79901

BoKS Manager can automatically create passwords for special 'service' accounts it uses to talk to Active Directory, similar to a safe that generates its own combination. The flaw means the way it picks that combination isn't random enough — it's based on the time the password was created, so someone who knows roughly when it happened could work out the combination and open the safe.

This matters to you if you run BoKS Manager (boks-server) and use its keytab management feature to generate or rotate Active Directory service-account passwords. If you don't use that specific password-generation feature, this issue does not apply to you.

This is rated critical because a successful guess hands an attacker a working Active Directory service-account credential with no login of their own needed, potentially opening the door to broader domain compromise. There is no confirmed active exploitation or public exploit code yet, but the predictable password-generation logic is straightforward to work out once understood, so you should rotate affected passwords and patch promptly rather than wait for signs of attack.

Confirm whether boks_keytabmd/keytab management is enabled in your BoKS Manager environment and identify all boks-server instances and their versions. Any version prior to 9.0.0.6 is vulnerable; the vendor fix lands in 9.0.0.6 with the recommended target being 9.0.0.7. Upgrade the active BoKS Master to 9.0.0.7 and restart BoKS before generating any new passwords — this is required because password generation logic only changes after the restart. Critically, patching does not retroactively secure passwords already generated: rotate all service-account passwords created by keytab management on the vulnerable version through BoKS's keytab management tooling, and verify the new key version has propagated to Active Directory and all consuming systems before considering remediation complete. There is no interim workaround short of manual password rotation outside the vulnerable generator if patching must be delayed. Monitor Active Directory authentication logs for the affected service accounts for anomalous or out-of-pattern logons as an added precaution, and watch for any vendor advisory updates given the sustained press attention this issue is receiving.

CVSS 9.9 (Critical), AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-exploitable with low privileges and no user interaction, high impact across confidentiality, integrity and availability, and scope change into connected systems. Weakness is CWE-338 (use of a cryptographically weak PRNG): boks_keytabmd seeds password generation with the Unix timestamp, reducing the keyspace to a small, offline-verifiable candidate set once the approximate generation time and service principal are known. Not in CISA KEV; no public exploit code identified; EPSS places predicted near-term exploitation likelihood as low with a flat trend. Exploit maturity is theoretical/proof-of-concept-level at this time, but the low attack complexity and credential-compromise impact justify prioritizing remediation over the low EPSS signal.