CVE-2026-79901

In deployments using BoKS keytab management, the boks_keytabmd daemon generates Active Directory service-account passwords from a predictable pseudo-random sequence seeded only with the current Unix timestamp. An attacker who knows a service principal and can estimate when its password was changed can reproduce a small set of candidate passwords and verify them offline, without touching the target system or leaving failed-login logs. Successful guessing yields valid AD service-account credentials, which can lead to privilege escalation and potentially broad domain compromise given the vulnerability's scope-changed, high-impact rating (CVSS 9.9). Organizations running BoKS keytab management to integrate Unix/Linux hosts with Active Directory are affected; the specific affected versions have not been disclosed in the available data. There is no known public proof of concept and no indication of in-the-wild exploitation at this time.

What to do: Apply the vendor patch for boks_keytabmd as soon as the fixed release is available from Fortra. Independently rotate every Active Directory service-account password and keytab that BoKS has generated, using a strong out-of-band random generator rather than the tool itself. Audit the affected service principals in AD for anomalous authentications or ticket activity and review their group memberships and privileges, since offline password verification leaves no failed-logon trail to alert on.