CVE-2025-13532

Published: Dec 16, 2025Modified: Jun 17, 2026Deferred

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.5 / Impact: 3.6

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff (Secondary)

Description

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.

Related CWEs

CWE-916

Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (1)

https://www.fortra.com/security/advisories/product-security/fi-2025-014

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Timeline

No history available yet.