VulnerabilityDeferred

CVE-2025-13532

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.

MEDIUM 6.2EPSS 0.10%

Does this matter?

Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.

Description

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.

CVSS 3.1: 6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.10% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-916
Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

References

https://www.fortra.com/security/advisories/product-security/fi-2025-014

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.