CVE-2026-9864

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

State: Published
Severity: 4.8 Medium
Published: Oct 1, 2026
Updated: Oct 1, 2026
Reserved: May 28, 2026

Description

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	Fortra

Weaknesses

CWE-338 Use of cryptographically weak Pseudo-Random number generator (PRNG)

Affected Products

Product	Versions
Core Privileged Access Manager (BoKS)Fortra	8.1.0.0 through 8.1.0.29Affected 9.0.0.0 through 9.0.0.5Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2026-018

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.