windows-utilities-release CVE-2026-41858

Exploitation requires that the target VM was provisioned with the windows-utilities-release randomize_password job from an affected version (pre-v0.23.0), that the attacker can reach an authentication surface that accepts the local Administrator credential (typically RDP/3389 or WinRM/5985-5986) over the network, and that the attacker can estimate the VM's boot time closely enough to reduce the PRNG seed search space to a tractable candidate list. Limiting factors: the randomize_password job must actually have been included in the deployment manifest (it is opt-in hardening, not default on every BOSH Windows VM); the local Administrator account must be reachable (deployments that block inbound RDP/WinRM at the network layer significantly raise the bar); and the attacker needs reasonably tight boot-time estimation - wider uncertainty enlarges the candidate set and may make online brute-forcing detectable or rate-limited. No special user interaction is required (UI:N) and no prior authentication is needed to attempt the recovered credential (PR:N).

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a pure confidentiality compromise reachable over the network with no authentication or user interaction, justifying the 7.5 base score. In practice the real-world severity depends on whether an attacker can plausibly estimate boot time (for cloud-managed BOSH deployments, deployment logs, monitoring endpoints, or RDP/WinRM banner timing can leak this) and whether the recovered Administrator account is reachable from the attacker's network position - so while the rating is High, exploitation typically requires at least network adjacency to the deployed Windows VMs. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and active-exploitation status are unknown; treat this as no public exploit identified at time of analysis. The signal mix is internally consistent: a cryptographic weakness with network-reachable impact and no integrity/availability effect, which fits a credential-recovery weakness rather than RCE.

An attacker with network reachability to a BOSH-managed Windows VM observes or infers the VM's boot time (e.g., from monitoring dashboards, deployment pipelines, BOSH director logs, RDP/WinRM service availability, or TCP timestamp options), enumerates the small candidate seed window around that time, generates the corresponding Administrator password candidates from the known Get-RandomPassword algorithm, and tries them against RDP or WinRM. A successful guess yields local Administrator on the VM, completely defeating the randomize_password hardening control.