CVE-2026-41858: BOSH Windows Administrator Password Generation Vulnerability

Technical summary

The vulnerability stems from CWE-338 (Weak Randomness / Insecure Cryptographic Primitive) in the Get-RandomPassword function within the randomize_password job. The password derivation process uses a clock-seeded pseudo-random number generator (PRNG) rather than a cryptographically secure random source. This allows an attacker with network visibility and the ability to estimate VM boot time to reconstruct candidate passwords. The seed space is constrained by the precision of the clock and boot time estimate, reducing the password search space from cryptographically infeasible to computationally tractable. Windows-utilities-release versions prior to v0.23.0 are affected; the vulnerability is resolved in v0.23.0 and later.

Business impact

For organizations deploying BOSH-managed Windows infrastructure, this vulnerability creates a direct path to Administrator-level compromise. An attacker gaining control of the local Administrator account can pivot to full system control, lateral movement, data exfiltration, and malware deployment. In cloud environments, this may enable escape to the underlying hypervisor or other VMs. The impact is particularly acute because the randomize_password job exists explicitly as a hardening control—its compromise negates a foundational security assumption.

Affected systems

All versions of BOSH-Ecosystem windows-utilities-release prior to v0.23.0 are vulnerable. Systems running v0.23.0 or later are patched. The vulnerability affects any deployment that relies on the randomize_password job to set the local Administrator password during Windows VM provisioning, typically in Pivotal Cloud Foundry (PCF), OpenStack, AWS, Azure, or other cloud environments where BOSH is used for Windows workload orchestration.

Exploitability

Exploitability requires network-level access to observe VM creation timing and sufficient information to estimate the boot timestamp (often publicly visible in cloud APIs or infrastructure logs). The attacker then generates a candidate password list and attempts authentication. The CVSS 3.1 score of 7.5 (HIGH) reflects network-attackable scope, no authentication requirement, and high confidentiality impact. Active exploitation is practical if boot time can be estimated to within minutes or seconds, which is feasible in many cloud environments. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade windows-utilities-release to v0.23.0 or later. This patch addresses the weak randomness issue by replacing the clock-seeded PRNG with a cryptographically secure random source. For immediate mitigation, apply access controls restricting network access to newly provisioned VMs during the boot window and consider using out-of-band authentication or secrets management systems (e.g., HashiCorp Vault, Azure Key Vault) to inject or retrieve the Administrator password rather than relying on client-side generation.

Patch guidance

Verify your current windows-utilities-release version in your BOSH environment. Patch to v0.23.0 or later and validate through a test environment before production deployment. Review your BOSH release manifests and deployment templates to ensure the randomize_password job is enabled; if disabled, you may be manually managing Administrator passwords, which should also be reviewed for cryptographic strength. After patching, re-deploy affected Windows VMs to apply the corrected password generation logic. Consult the official BOSH release notes for detailed upgrade instructions and any breaking changes.

Detection guidance

Monitor BOSH deployment logs and Windows Event Viewer for unusual authentication attempts targeting the local Administrator account, particularly around the timestamp of VM provisioning. Set up alerting on failed Administrator login attempts across newly deployed instances. If you maintain baseline telemetry on your BOSH infrastructure, look for VMs provisioned before the patch window and cross-reference their creation times with any successful unexpected logins. Network-based detection is limited; focus on log analysis and credential access patterns.

Why prioritize this

This vulnerability merits immediate prioritization because it directly defeats a hardening control, affects foundational infrastructure security (VM provisioning), and requires no user interaction or authentication. HIGH severity, practical exploitability in cloud environments, and the fact that it undermines a security best practice make this a critical remediation target. Organizations with significant Windows workloads on BOSH should prioritize patching within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-exploitable vulnerability with low attack complexity, no privileges required, and high confidentiality impact (full Administrator account compromise). Integrity and availability are not directly impacted by the vulnerability itself, but once an attacker gains Administrator access, both can be compromised. The score is appropriate and reflects the severity of an unguessable password mechanism becoming guessable.

Frequently asked questions