Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
CVE-2026-9864
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-9864
Core Privileged Access Manager (BoKS)
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Fortra",
"modules": [
"adjoin"
],
"product": "Core Privileged Access Manager (BoKS)",
"versions": [
{
"status": "affected",
"version": "8.1.0.0",
"versionType": "custom",
"lessThanOrEqual": "8.1.0.29"
},
{
"status": "affected",
"version": "9.0.0.0",
"versionType": "custom",
"lessThanOrEqual": "9.0.0.5"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-9864
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #5691 · Revision 1
- Added to Heist Feed
- Publisher date