Fortra BoKS Manager CVE-2026-79896

Exploitation requires network access to the custom TLS listener exposed by the boks_portmux daemon on a BoKS Manager host; the attacker submits a single malformed ClientHello to crash it, with no authentication, credentials, or user interaction needed (AV:N/PR:N/UI:N). The key limiting factor is that impact is transient - boks_portmux is normally restarted automatically - so achieving a meaningful outage requires sustained, repeated malformed requests rather than one packet. Realistic risk is further bounded by the niche deployment of BoKS Manager and by whether the boks_portmux TLS port is reachable from the attacker's network position.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the description: a remote, unauthenticated, low-complexity attacker crashes boks_portmux via a malformed TLS ClientHello, yielding a pure availability impact (C:N/I:N) with no data disclosure or code execution. Despite the CWE-125 out-of-bounds READ classification and the 'Information Disclosure' tag, the described outcome is exclusively denial-of-service - the parser terminates rather than leaking memory, so this should be treated as an availability bug, not an info-leak. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis. Mitigating the real-world severity: the daemon auto-restarts, so impact is a sustained-flood DoS requiring repeated requests rather than a single permanent kill, and the affected product (Fortra BoKS Manager, a niche enterprise PAM/access-control server) has a small deployment footprint. Net: a genuine but moderate availability risk against a specialized central policy component - notable because boks_portmux is network-facing and the attack needs no authentication.

A remote attacker with network reachability to the boks_portmux TLS listener sends a crafted, malformed ClientHello that triggers the out-of-bounds read in the custom parser, crashing the daemon. Because the service auto-restarts, the attacker scripts a loop that re-sends the malformed handshake on each restart, sustaining an effective denial of the BoKS access-control service. No authentication or user interaction is required; no public POC is currently identified.