CVE-2025-13532

The record

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.  This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.

Affected packages

Related vulnerabilities

• CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
• CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916
• CVE-2026-81689 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted… CWE-916
• CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. CWE-916
• CVE-2026-74871 openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR… CWE-916
• CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in… CWE-916
• CVE-2026-55069 Kestra is an open-source, event-driven orchestration platform. CWE-916