Fortra BoKS Manager EUVD-2026-90871

Requires a local, authenticated low-privileged account on the BoKS Master host specifically (not a managed client), with read access to files under the BOKS_tmp directory. Exploitation further depends on the bccgethostcert utility being executed by a privileged user - the attacker either wins a timing window while it runs or reads CA secret material left behind after a successful certificate creation. Limiting factors: local-only attack vector (no remote/network path), the need for the utility to actually be invoked (UI:R), and the restricted population of users who have accounts on the Master. The root cause is the utility failing to set a restrictive umask before creating predictably-named temporary files.

This is a genuine but access-gated local vulnerability, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9) correctly captures that exploitation is LOCAL (AV:L) and requires an existing low-privileged account (PR:L) on the BoKS Master host specifically, plus user interaction (UI:R) - an administrator must run the bccgethostcert utility, or have run it leaving material behind. The high base score is driven by the scope change (S:C) and C:H/I:H, which are justified: the leaked artifact is CA secret or host private-key material, whose compromise lets an attacker forge trusted certificates and impersonate hosts across the PAM trust domain - hence the integrity impact and scope change beyond the single host. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public-exploitation signal; combined with the local-only vector and the niche deployment footprint, this is a moderate-priority patch-when-able item for environments running BoKS, not a drop-everything issue. One caveat: the description frames the clearest attack (reading leftover material after cert creation) as not needing a live race, which supports AC:L, but the 'while the utility runs' variant is a classic TOCTOU race that in practice is harder to win - the AC:L rating is slightly generous for that path.

A local user with a shell account on the BoKS Master monitors the BOKS_tmp directory. When an administrator runs bccgethostcert to create or renew a certificate, the utility writes predictable temporary files with a permissive umask; the attacker reads the CA secret or host private-key material from those files during the operation, or recovers CA secret material left behind afterward. No public exploit code was identified, and exploitation requires an existing local account and that the utility be run.