CVE-2026-47830
Received Received - Intake

Incorrect Permission Assignment in BOSH Windows Stemcell Builder

Publication date: 2026-07-09

Last updated on: 2026-07-09

Assigner: VMware

Description
Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-09
Last Modified
2026-07-09
Generated
2026-07-09
AI Q&A
2026-07-09
EPSS Evaluated
N/A
NVD
CVE-2026-47830
EUVD
EUVD-2026-42516

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vmware_tanzu bosh-windows-stemcell-builder to 2019.98 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47830 is a high-severity vulnerability in the bosh-windows-stemcell-builder software, specifically in the BOSH.Utils.psm1 module. It involves incorrect permission assignments that allow low-privilege authenticated users to overwrite critical executable files such as C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe.

By exploiting this flaw, an attacker can gain NT AUTHORITY\SYSTEM privileges when the affected services restart or the system reboots, potentially leading to full control over the host system.

Impact Analysis

This vulnerability can allow an attacker with low-level access to escalate their privileges to the highest system level (NT AUTHORITY\SYSTEM).

As a result, the attacker could gain full control over the affected host, including the ability to execute arbitrary code, modify system configurations, and potentially compromise other systems or data.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the bosh-windows-stemcell-builder software to version v2019.98 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart