CVE-2026-47830: Windows BOSH Stemcell Builder Privilege Escalation Vulnerability

Technical summary

CVE-2026-47830 stems from incorrect permission assignment in the BOSH.Utils.psm1 PowerShell module used by bosh-windows-stemcell-builder. The vulnerability allows low-privilege authenticated users to write to or overwrite files in the C:\bosh directory, specifically targeting service_wrapper.exe and bosh-agent.exe. Because these executables are subsequently invoked by the Windows service control manager (typically running as NT AUTHORITY\SYSTEM), an attacker can inject arbitrary code that executes with full system privileges upon service restart or system reboot. The flaw is a classic case of insecure file permissions enabling privilege escalation.

Business impact

Organizations using BOSH for Windows infrastructure automation face a critical insider threat. Any authenticated user (developer, operator, or contractor with system access) can escalate privileges and compromise host integrity. This enables data exfiltration, lateral movement within the BOSH-managed environment, installation of persistent backdoors, denial of service, and tampering with cloud infrastructure deployments. For enterprises relying on BOSH for multi-tenant or production cloud environments, this represents a path to complete infrastructure compromise.

Affected systems

The vulnerability affects bosh-windows-stemcell-builder versions prior to v2019.98. Any Windows-based BOSH deployment using a vulnerable stemcell version is at risk. Organizations should inventory their BOSH Windows stemcell versions in development, staging, and production environments to determine exposure.

Exploitability

The attack requires local access and valid credentials but no special privileges—a low-privilege authenticated user can exploit this. No user interaction or complex conditions are needed; an attacker simply overwrites the target executables and triggers a service restart or system reboot. The CVSS 3.0 score of 8.8 (HIGH) reflects the ease of exploitation and the severe impact (full system compromise). This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the published date, but the straightforward exploitation path means attack tooling could emerge quickly.

Remediation

Upgrade bosh-windows-stemcell-builder to version v2019.98 or later. This patched version corrects the file permission assignment in BOSH.Utils.psm1 to restrict write access to the C:\bosh directory to authorized service accounts only. After upgrading the builder, rebuild and redeploy Windows stemcells to all BOSH environments.

Patch guidance

1. Verify your current bosh-windows-stemcell-builder version via your BOSH director or stemcell metadata. 2. Obtain version v2019.98 or later from the official BOSH project repository. 3. Update your stemcell build pipeline to use the patched version. 4. Rebuild all Windows stemcells in your environment. 5. Redeploy affected Windows VMs to apply the corrected permissions. 6. Test service restart and system reboot scenarios in a non-production environment first to ensure service stability. 7. For existing deployments running vulnerable stemcells, consider implementing operating system-level access controls and audit logging to detect unauthorized file modifications in C:\bosh until stemcells can be updated.

Detection guidance

Monitor Windows event logs for: - Unauthorized modifications to C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe (File Integrity Monitoring or Windows Auditing). - Unexpected SYSTEM-level process launches from the C:\bosh directory. - Failed or unusual service restarts for the BOSH agent service. Implement file integrity checks on critical BOSH binaries and alert on any changes outside of scheduled maintenance. Use Windows Auditing to log and monitor object access (Create, Write) to the C:\bosh directory, filtering for non-service accounts.

Why prioritize this

This vulnerability merits urgent patching. It combines a low attack barrier (any authenticated user) with maximum impact (full system compromise). BOSH environments often run cloud infrastructure that may host customer workloads or sensitive internal applications. The attacker does not need special tools or exploits; standard file operations suffice. Although not yet appearing in active threat intelligence, the simplicity of exploitation and the high-stakes environment make this a near-term priority, especially for production or multi-tenant BOSH deployments.

Risk score, explained

The CVSS 3.0 score of 8.8 reflects: Attack Vector (Local) and low Attack Complexity, combined with low Privilege Requirements. The impact scores are all High—full confidentiality, integrity, and availability compromise of the affected system. The Scope is Changed because privilege escalation on one system can be used to compromise other systems in the BOSH-managed infrastructure. No mitigating factors (such as user interaction or attack complexity) reduce the score.

Frequently asked questions