Executive brief
A security flaw in the Cloud Foundry windows-utilities-release package allows attackers to guess the local Administrator password on Windows virtual machines. This component is intended to secure systems by setting a random, unguessable password, but a technical error makes these passwords predictable based on when the machine started. An attacker who successfully guesses the password could gain full administrative control over the affected virtual machine.
Technical details
The Get-RandomPassword function in the windows-utilities-release (BOSH-Ecosystem) utilizes a cryptographically weak pseudo-random number generator (PRNG) seeded by the system clock. Because the randomize_password job runs during the boot sequence, the entropy is insufficient, allowing a network-based attacker to estimate the VM boot time and generate a small list of candidate passwords. By brute-forcing this limited set, an attacker can recover the local Administrator credentials, bypassing intended hardening controls. The issue is resolved in version 0.23.0 by implementing a more secure cryptographic primitive.
Affected products
- Cloud Foundry Foundation windows-utilities-release versions prior to v0.23.0
Timeline
- 2026-06-01: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-06-03: disclosed: CVE published to NVD dataset
- 2026-06-04: other: NVD record updated