BoKS Manager EUVD-2026-90848

Exploitation is limited to deployments that use BoKS keytab management, where boks_keytabmd generates Active Directory service-account passwords, on affected versions before boks-server 9.0.0.6. The attacker must (1) know the exact target service principal name and (2) be able to estimate the password-change time closely enough to reconstruct the timestamp-seeded candidate set, then (3) have an offline verification oracle (e.g., a captured Kerberos ticket/hash or authentication endpoint) to confirm the correct candidate. These are the practical limiting factors: environments not using BoKS AD keytab/service-account automation are not exposed, and the required timing estimation plus offline brute-forcing of the candidate set makes exploitation targeted and effort-dependent rather than trivial.

Signals conflict, and the conflict matters. The input CVSS 3.1 vector (9.9, AV:N/AC:L/PR:L/UI:N/S:C) paints a near-worst-case, trivially-exploitable network flaw, but CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', while only Technical Impact ('total') agrees with the high score. The description itself contradicts AC:L: successful exploitation requires knowing the target service principal AND estimating the password-change time to reconstruct a limited candidate set for offline verification - that is meaningful attacker effort, not low complexity, so the true attack complexity is High. No EPSS score, KEV listing, or POC was provided; combined with SSVC Exploitation 'none', this is best read as a serious-but-not-yet-exploited weakness. Bottom line: the 9.9 overstates real-world urgency. The flaw is genuinely high-impact (predictable credentials for AD service accounts, CWE-338) but currently represents a targeted, effort-dependent risk rather than mass-exploitable, drive-by compromise. Treat as a priority patch for organizations that actually use BoKS keytab management for Active Directory, and lower priority elsewhere. Note: input CVSS lists PR:L (authenticated), yet computing the candidate passwords needs only knowledge of the public service principal name, not account privileges - verify intended privilege assumption with Fortra advisory FI-2026-012.

An attacker who knows the name of an Active Directory service principal managed by BoKS keytab management estimates roughly when its password was last rotated, then uses the predictable timestamp-seeded pseudo-random sequence to regenerate the small set of possible passwords. The attacker verifies the correct password offline (e.g., against a captured Kerberos artifact or authentication oracle) and then authenticates to Active Directory as that service account. No public exploit identified at time of analysis.