CVE-2026-9864 in Core Privileged Access Manager
Summary
by MITRE • 10/01/2026
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Fortra BoKS Server Agent contains a critical security flaw within its adjoin utility that compromises the integrity of machine-account passwords during Active Directory integration and renewal processes. This vulnerability stems from a predictable password generation mechanism, where the cryptographic randomness used to create these credentials is insufficiently robust. In secure systems, machine accounts require high-entropy secrets to prevent unauthorized access, but in this instance, the algorithm fails to produce truly random values. Instead, it generates passwords with significantly less entropy than intended by design standards for enterprise identity management solutions. This deficiency means that an attacker who can estimate or determine when a password was generated may be able to predict subsequent credentials through statistical analysis or brute-force techniques tailored to the specific weakness in the generation logic.
From a technical perspective, this issue represents a fundamental failure in random number generation practices within authentication workflows. The adjoin utility is responsible for establishing trust relationships between client systems and Active Directory domains by creating machine accounts with unique passwords. When these passwords are derived from predictable patterns or low-entropy sources such as system time without sufficient cryptographic mixing, the resulting secrets become vulnerable to reconstruction. An adversary capable of observing network traffic or gaining limited access to log files could potentially correlate timestamps with password generation events. By leveraging knowledge of the algorithm's weaknesses and the approximate timing of account creation or renewal, an attacker might successfully guess valid machine-account passwords. This undermines the core security principle that authentication secrets must be computationally infeasible to predict even if partial information about their generation is known.
The operational impact of this vulnerability is severe for organizations relying on Fortra BoKS Server Agent for centralized identity and access management. If an attacker obtains or predicts valid machine-account passwords, they can authenticate as those machines within the Active Directory environment. This grants them unauthorized network access equivalent to that of a legitimate system account, potentially allowing lateral movement across the domain. Once inside, attackers could escalate privileges, exfiltrate sensitive data, deploy malware, or establish persistent backdoors under the guise of trusted systems. Since machine accounts often possess broad permissions necessary for software deployment and configuration management, compromising them provides a powerful foothold for advanced persistent threats seeking to infiltrate critical infrastructure.
This vulnerability aligns with CWE-330: Use of Insufficiently Random Values, which categorizes flaws where random numbers are used in security-critical contexts but lack sufficient entropy or unpredictability. Additionally, it relates to ATT&CK technique T1528: Steal Application Access Token, as predicted machine credentials can be used to impersonate systems and access resources without detection by standard identity monitoring tools. The predictability of these passwords effectively bypasses multi-factor authentication protections that might otherwise rely on unique per-session or per-device secrets, thereby weakening the overall security posture of the Active Directory infrastructure.
To mitigate this risk, organizations should immediately apply any available patches from Fortra that address the password generation logic in the adjoin utility. Until updates are deployed, administrators should consider rotating machine-account passwords manually if feasible and restrict network access to BoKS Server Agent components to only trusted management subnets. Implementing strict monitoring for unusual authentication patterns involving newly created or renewed machine accounts can help detect potential exploitation attempts early. Furthermore, reviewing Active Directory security policies to ensure that no single compromised account grants excessive privileges will limit the blast radius of such an incident. Regular audits of identity management configurations and adherence to NIST guidelines on cryptographic strength are essential steps in preventing similar vulnerabilities from impacting enterprise environments.