CVE-2026-12627

CriticalCVSS 9.8

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

Risk Assessment

A remote attacker could cause memory corruption in the autoregistration service, potentially leading to code execution or destabilization of the privileged access management system.

Recommendation

Apply Fortra's patches for boks_autoregisterd and restrict network access to the autoregistration service to trusted clients only.

Other vulnerabilities in Fortra BoKS

CVE-2026-79901Critical
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS