bosh-windows-stemcell-builder CVE-2026-47831

Exploitation requires that the target Windows VM was built from a bosh-windows-stemcell-builder stemcell of a version prior to v2019.98 (so its SSH password came from the weak GenerateRandomPassword function) AND that the attacker can reach the VM's SSH service on TCP/22. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the vendor rates the vector as AV:A (Adjacent), implying the attacker must be on the same or an adjacent/management network segment rather than the open internet, and AT:P indicates a specific attack requirement - realistically that the credential was generated by the affected code path; VMs whose passwords were subsequently rotated or that were built with v2019.98+ are not exploitable.

The vendor CVSS 4.0 score is 7.7 (High) with vector AV:A/AC:L/AT:P/PR:N/UI:N and High confidentiality, integrity and availability impact - reflecting unauthenticated, low-complexity access that fully compromises the host once the password is guessed. Note a signal conflict: the vendor's vector uses AV:A (Adjacent) and AT:P (an attack requirement), yet the description characterises a 'remote attacker' brute-forcing 'TCP/22', which reads as network-reachable (AV:N) - this suggests the adjacency rating assumes stemcell VMs sit on segmented management networks rather than the open internet; verify network exposure against your actual BOSH deployment topology. EPSS is not provided, there is no POC and the CVE is not in CISA KEV, so there is no evidence of active or automated exploitation today. Real-world priority is moderate-to-high for organisations running Cloud Foundry Windows workloads because the weakness is systemic (every image from an affected build is weak) and requires no privileges, but exposure hinges on whether TCP/22 of stemcell-derived VMs is reachable by an attacker.

An attacker with network reachability to a Windows VM deployed from a vulnerable stemcell targets its SSH service on TCP/22 and, knowing the password came from a weak PRNG, iterates the small predictable keyspace instead of a full brute force. Given the low attack complexity, a successful guess yields interactive administrative access to the host. No public exploit code is currently identified, but the weakness is straightforward to weaponise.