EUVD-2026-90889
GHSA-rh95-jwc3-f9fr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstimate machine-account password generation time window
-
DeliveryModel adjoin weak-entropy keyspace
-
ExploitBrute-force reduced candidate passwords
-
ExecutionRecover AD machine-account credential
-
ImpactAuthenticate as compromised machine account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic PRNG selection
|
| Exploitation Conditions | Exploitation requires a BoKS Server Agent that performed an Active Directory join or machine-account password renewal via the affected adjoin utility, producing a machine-account password with significantly reduced entropy. The attacker must be able to estimate the time at which that password was generated in order to narrow and predict the value - this timing dependency, reflected as AC:H, is the primary limiting factor. The flaw is scoped to AD-integrated BoKS deployments using adjoin; environments not joined to Active Directory or using externally managed machine-account credentials are not exposed, and impact is limited to predicting that specific machine-account credential rather than direct host compromise. |
| Impact | This is a moderate-severity cryptographic weakness (CVSS 4.8, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) rather than a high-urgency flaw. The vector lists AV:N and PR:N (no authentication required), but AC:H is the dominant limiter: successful exploitation requires the attacker to estimate the time window in which the machine-account password was generated and then brute-force a reduced-entropy keyspace, which is non-trivial and target-specific. The impact is scoped to low confidentiality and low integrity with no availability impact, consistent with recovering/predicting a single machine-account credential rather than full system takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation - this reads as a targeted, opportunistic weakness against specific deployments, not a mass-exploitation priority. One note: PR:N in the CVSS vector means it is technically unauthenticated, but exploitation realistically depends on the attacker having visibility into or the ability to estimate password-generation timing, so real-world attacker prerequisites are higher than the raw 'network/unauthenticated' framing implies. |
| Exploit ScenarioDerived | An attacker who can observe or infer when a BoKS Server Agent performed an Active Directory join or machine-account password renewal uses the known weak entropy of the adjoin utility's password generator to constrain and brute-force the resulting machine-account password. Having predicted the credential, they authenticate to Active Directory as that machine account. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) reflects the timing-estimation and search effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Predictable machine-account passwords produced by the adjoin utility in Fortra BoKS Server Agent can be guessed by a remote, unauthenticated attacker who can estimate when the password was generated, because the utility's generation routine yields significantly less entropy than intended. Rated CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), the exposure is limited to AD-integrated deployments that ran an Active Directory join or machine-account password renewal through adjoin; the timing dependency required to narrow the password space is the principal barrier, reflected in the high attack-complexity metric. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the impact is confined to predicting that specific machine-account credential rather than achieving direct host compromise.
RemediationAI
Apply the vendor fix as soon as Fortra publishes it: consult the product security advisory at https://www.fortra.com/security/advisories/product-security/fi-2026-018 to identify the patched BoKS Server Agent build and upgrade to that exact version - no specific fix version was included in the available intelligence, so the version number must be taken from the advisory rather than assumed. Because the vulnerable artifact is a stored credential, patching alone does not undo the exposure of passwords already generated, so immediately rotate every AD machine-account password that was created or renewed by adjoin, generating the replacement from a high-entropy external source instead of letting adjoin regenerate it (the trade-off is that any rotation performed before the code fix can itself reintroduce a weak secret, so rotate again after upgrading). Until patching is possible, the practical compensating controls are to stop using adjoin for join/renewal and provision machine credentials out of band, which breaks the automated AD integration workflow and requires manual lifecycle management; to shorten machine-account password lifetimes so a predicted value has a smaller useful window, which increases operational overhead and AD replication churn; and to restrict network reachability of the AD join/renewal channels to the specific management hosts that require them, which reduces the attacker population but does not remove the weakness for an attacker already positioned on the management network. Finally, add detection for anomalous or repeated authentication attempts against BoKS/AD machine accounts, since the high attack complexity here means a real attack would likely appear as iterative guessing rather than a single event.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-338 weakness - use of a cryptographically weak pseudo-random number generator - in the adjoin utility of Fortra BoKS Server Agent, which automates joining a BoKS host to an Active Directory domain and periodically renewing the associated machine-account password. Machine-account secrets should be high-entropy random values, but here the password-generation path produces far fewer effective bits than intended, so an adversary who can approximate the generation timestamp can prune the candidate space and predict the credential. Because the CVSS vector is AV:N/AC:H/PR:N/UI:N with C:L/I:L/A:N, exploitation is remote and requires no prior authentication or user interaction, but is constrained by the need to estimate timing, and the consequence is limited to disclosure and possible misuse of that one AD machine credential - the advisory does not describe a path from the predicted password to code execution or loss of availability. Environments that are not AD-integrated, or that manage machine-account credentials outside adjoin, sit outside the vulnerable code path entirely.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H because exploitation needs password-generation timing estimation plus brute-forcing a reduced keyspace; PR:N as no prior auth is required; C:L/I:L for credential prediction, A:N as no availability impact.
Primary rating from Vendor (df4dee71-de3a-4139-9588-11b62fe6c0ff).
CVSS VectorVendor: df4dee71-de3a-4139-9588-11b62fe6c0ff
DescriptionCVE.org
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB