CVE-2026-79901
Received Received - Intake

BoKS keytabmd Predictable Password Generation

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Fortra

Description
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-79901
EUVD
EUVD-2026-90848

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects BoKS keytab management systems where boks_keytabmd generates Active Directory service-account passwords using a predictable pseudo-random sequence seeded with the Unix timestamp. Attackers can exploit this by knowing the service principal and estimating password-change time to reproduce a limited set of candidate passwords and verify them offline.

Impact Analysis

An attacker could gain unauthorized access to Active Directory services by guessing passwords, leading to potential data breaches, privilege escalation, or disruption of services. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance penalties, legal consequences, and reputational damage due to potential data breaches.

Mitigation Strategies

Update to the latest version of boks_keytabmd that fixes the predictable password generation issue. Disable or restrict access to the service principal used for keytab management until patched. Monitor Active Directory for unauthorized password changes or access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart