PT-2025-51782 · Fortra · Fortra Core Privileged Access Manager+1

Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-13532

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortra Core Privileged Access Manager (BoKS) versions 9.0

Description The Server Agent component of Fortra's Core Privileged Access Manager (BoKS) has insecure defaults that can lead to the selection of weak password hash algorithms. This issue impacts instances running BoKS Server Agent 9.0 that support yescrypt within a BoKS 8.1 domain.

Recommendations Ensure BoKS Server Agent 9.0 instances do not select weak password hash algorithms.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2025-13532

Affected Products

Boks Server Agent

Fortra Core Privileged Access Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13532 · Security Note
• https://t.me/CVEtracker/40004 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001152773497245779 · Twitter Post
• https://twitter.com/CVEnew/status/2001350865094087117 · Twitter Post
• https://fortra.com/security/advisories/product-security/fi-2025-014 · Note