Which versions of bosh-windows-stemcell-builder are affected by CVE-2026-47831?

Cloud Foundry bosh-windows-stemcell-builder versions prior to v2019.98 ship Windows virtual machines with predictable administrative passwords, creating a critical exposure in any organization's…. A patch is available.

How to fix or mitigate CVE-2026-47831?

24 hours: Inventory all deployed Windows stemcells and document bosh-windows-stemcell-builder versions; restrict SSH port 22 access to trusted administrative networks only via network segmentation. 7 days: Immediately rotate administrative and SSH credentials on all deployed Windows VMs using cryptographically secure random methods; monitor Cloud Foundry releases for builder version v2019.98 or later. 30 days: Upon availability of patched builder v2019.98+, rebuild all Windows stemcells and redeploy infrastructure; audit SSH and administrative access logs for any unauthorized access during the exposure window.

bosh-windows-stemcell-builder CVE-2026-47831

Q: What is the CVSS score of CVE-2026-47831?

CVE-2026-47831 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42517 HIGH

2026-07-09 vmware

GHSA-4qp9-f9vm-49xq

Information Disclosure Microsoft Bosh Windows Stemcell Builder Cloud Foundry Foundation

7.7

CVSS 4.0 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

SSH is network-reachable (AV:N; vendor chose AV:A assuming segmented mgmt network) and weak PRNG makes guessing feasible (AC:L, PR:N, UI:N); full host access gives C/I/A High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 08:01 EUVD

Analysis Generated

Jul 09, 2026 - 07:21 vuln.today

CVE Published

Jul 09, 2026 - 06:26 cve.org

HIGH 7.7

DescriptionCVE.org

Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

AnalysisAI

Predictable SSH credential generation in Cloud Foundry's bosh-windows-stemcell-builder (versions prior to v2019.98) lets attackers brute-force the SSH login on TCP/22 because the GenerateRandomPassword function relies on a cryptographically weak random number generator, drastically shrinking the effective password keyspace. Any Windows stemcell built with an affected release ships with a guessable administrative password, so an attacker who can reach port 22 of a deployed VM can recover interactive access and full control. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

bosh-windows-stemcell-builder is the Cloud Foundry BOSH tooling that produces Windows 'stemcell' base images used to deploy Windows VMs across IaaS providers. During image construction the GenerateRandomPassword routine sets the SSH/administrative password, but instead of a cryptographically secure source (e.g. crypto/rand) it uses a weak, predictable PRNG. This maps to the CWE-338 class (Use of Cryptographically Weak PRNG) - the generator's limited entropy or predictable seeding means output passwords cluster in a small, guessable space rather than the full character-length keyspace they appear to have. The affected component is identified by CPE cpe:2.3:a:cloud_foundry_foundation:bosh-windows-stemcell-builder and the exposed service is the OpenSSH-style listener on TCP/22 baked into the resulting stemcell.

RemediationAI

Vendor-released patch: upgrade bosh-windows-stemcell-builder to v2019.98 or later, then rebuild all Windows stemcells and redeploy the VMs created from vulnerable stemcells so they receive freshly, securely generated credentials - patching the builder alone does not remediate images or running VMs already produced with weak passwords. As immediate compensating controls until rebuilds complete, rotate/reset the SSH administrative passwords on already-deployed Windows VMs to strong values, and restrict inbound access to TCP/22 on stemcell-derived VMs via security groups/firewall rules so only trusted management jump hosts can reach it (trade-off: may disrupt legitimate automation or operator SSH workflows that assume broad reachability). See the Cloud Foundry advisory for details: https://www.cloudfoundry.org/blog/cve-2026-47831-cryptographically-weak-password-generation-in-bosh-windows-stemcell-builder-allows-remote-ssh-brute-force-attacks/