CVE-2026-79899: Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Published Oct 1, 2026

Updated

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.

Affected Software

1 affected component

Fortra BoKS Manager

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade boks-server to a version that resolves this vulnerability.
Fixed in 8.1.0.24
Upgrade
Upgrade boks-server to a version that resolves this vulnerability.
Fixed in 9.0.0.7

Event History

Oct 1, 2026

CVE Published

via MITRE·02:37 PM

Data Sourced

via MITRE·02:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

The issue affects local users on the BoKS Master who can read files under BOKS_tmp. Exposure occurs while bccgethostcert runs, and CA secret material may also remain accessible after successful certificate creation.

What does an attacker need to exploit it?

An attacker needs local access and permission to read files under BOKS_tmp on the BoKS Master. They may then access predictable temporary files created by bccgethostcert.

What sensitive material could be disclosed?

The temporary files may expose CA secret material or host private-key material while the utility is running. CA secret material may also be left behind after a certificate is successfully created.