CVE-2026-47830

HighCVSS 8.8

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

A vulnerability in the BOSH.Utils.psm1 script of bosh-windows-stemcell-builder allows low-privileged authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon service or system restart, an attacker can gain NT AUTHORITY\SYSTEM privileges, leading to full host control.

Risk Assessment

The organization is at risk of complete system takeover by an attacker with low privileges, potentially resulting in data theft, malware installation, or lateral movement within the network.

Recommendation

Immediately upgrade bosh-windows-stemcell-builder to version v2019.98 or later. As a workaround, restrict write access to C:\bosh\service_wrapper.exe and C:\bosh\bosh-agent.exe to trusted administrative accounts only.

Other vulnerabilities in bosh-windows-stemcell-builder

CVE-2026-47831High
The GenerateRandomPassword function in bosh-windows-stemcell-builder uses a cryptographically weak random number generator, allowing a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions are prior to v2019.98.

Original NVD description (English source)

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.