CVE-2026-79899

HighCVSS 7.9/10Last modified Oct 1, 2026

Description

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-377

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
FortraBoKS Manager>= 8.1.0.0, <= 8.1.0.23; >= 9.0.0.0, <= 9.0.0.6

References

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-79907.8Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to performCVE-2026-799006.5boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSLCVE-2026-799019.9In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a pCVE-2026-799025.5A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a VariablCVE-2026-799045.0Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could rCVE-2026-799055.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-799067.8Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-799077.8Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. CVE-2026-799087.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-799097.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-79918.8Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute aCVE-2026-799105.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lever