Which versions of bosh-windows-stemcell-builder are affected by CVE-2026-47830?

Windows infrastructure deployed through BOSH stemcell versions prior to v2019.98 is vulnerable to privilege escalation attacks, allowing low-privilege users to gain SYSTEM-level administrative…. A patch is available.

How to fix or mitigate CVE-2026-47830?

Within 24 hours: Audit BOSH deployments and identify all systems running stemcell versions prior to v2019.98. Within 7 days: Implement ACL hardening on C:\bosh\ directory to restrict low-privilege account access; enforce strict permissions on service_wrapper.exe and bosh-agent.exe files; review and restrict low-privilege user permissions on affected systems. Within 30 days: Upgrade all affected systems to BOSH Windows Stemcell Builder v2019.98 or later and rebuild VMs with patched stemcell images.

bosh-windows-stemcell-builder CVE-2026-47830

Q: What is the CVSS score of CVE-2026-47830?

CVE-2026-47830 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42516 HIGH

2026-07-09 vmware

GHSA-v8gm-j274-p577

Information Disclosure Microsoft Bosh Windows Stemcell Builder Cloud Foundry Foundation

8.5

CVSS 4.0 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local low-privilege authenticated user (AV:L, PR:L) overwrites a SYSTEM-run binary with no user interaction, gaining full host control (C/I/A:H); scope unchanged as impact stays on the same host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 08:01 EUVD

Analysis Generated

Jul 09, 2026 - 07:20 vuln.today

CVE Published

Jul 09, 2026 - 06:25 cve.org

HIGH 8.5

DescriptionCVE.org

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

AnalysisAI

Local privilege escalation in BOSH-Ecosystem bosh-windows-stemcell-builder (versions prior to v2019.98) lets a low-privilege authenticated Windows user overwrite the BOSH agent executables at C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe, which then run as NT AUTHORITY\SYSTEM on the next service restart or reboot, yielding full host control. The weakness stems from overly permissive filesystem ACLs applied by BOSH.Utils.psm1 when the stemcell is built. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the PowerShell module BOSH.Utils.psm1 used by bosh-windows-stemcell-builder to provision Windows stemcells (base VM images) for Cloud Foundry / BOSH-managed Windows cells. During image construction the module assigns incorrect (overly permissive) permissions to the C:\bosh directory and the executables it contains, so standard authenticated users retain write access to files that are executed by a service running as LocalSystem. This is the classic CWE-732 (Incorrect Permission Assignment for Critical Resource) / weak-service-executable-ACL pattern: the BOSH agent runs as SYSTEM, and because its on-disk binary is writable by unprivileged users, control of the file equals control of the SYSTEM process. The CPE cpe:2.3:a:cloud_foundry_foundation:bosh-windows-stemcell-builder confirms the builder itself as the vulnerable artifact, but the exposure is realized on every Windows host provisioned from an affected stemcell.

RemediationAI

Vendor-released patch: upgrade bosh-windows-stemcell-builder to v2019.98 or later and rebuild/redeploy Windows stemcells so newly provisioned hosts receive correct C:\bosh permissions; details at https://www.cloudfoundry.org/blog/cve-2026-47830-incorrect-permission-assignment-allows-local-privilege-escalation-to-system-via-executable-overwrite/. Rebuilding the builder alone is insufficient - already-deployed Windows cells built from vulnerable stemcells remain exposed and must be recreated from a fixed stemcell. As an interim compensating control on existing hosts, tighten the ACLs on C:\bosh and its executables (service_wrapper.exe, bosh-agent.exe) to remove write/modify rights for the Authenticated Users / Users groups, leaving only SYSTEM and Administrators with write access; the trade-off is that manual ACL changes can be reverted by agent updates or stemcell re-provisioning and should be verified after any BOSH operation. Additionally restrict interactive/low-privilege logon to BOSH-managed Windows hosts to shrink the pool of accounts able to abuse the writable path.