CVE-2025-13532

Weak Password Hash in Core Privileged Access Manager (BoKS)

State: Published
Severity: 6.2 Medium
Published: Dec 16, 2025
Updated: Dec 16, 2025
Reserved: Nov 21, 2025

Description

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Fortra

Weaknesses

CWE-916 Use of Password Hash With Insufficient Computational Effort

Affected Products

Product	Versions
Core Privileged Access Manager (BoKS)Fortra	This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain. The affected platforms are: Debian 11, 12, 13, RedHat 9, 10 and Ubuntu 24.Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2025-014

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.