Is CVE-2026-41858 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41858 being exploited in the wild.

How severe is CVE-2026-41858?

High severity, with a CVSS score of 7.5, published 4 June 2026.

Which products and versions are affected?

Cloud Foundry Foundation windows-utilities-release versions prior to v0.23.0.

Is there a fix for CVE-2026-41858?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41858 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41858?

Check whether you run Cloud Foundry Foundation Windows Utilities Release. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41858: Cloud Foundry windows-utilities-release Weak PRNG in Get-RandomPassword

CVE-2026-41858 · Severity: high · CVSS 7.5 · Published 2026-06-04

A security flaw in the Cloud Foundry windows-utilities-release package allows attackers to guess the local Administrator password on Windows virtual machines. This component is intended to secure systems by setting a random, unguessable password, but a technical error makes these passwords predictable based on when the machine started. An attacker who successfully guesses the password could gain full administrative control over the affected virtual machine.

Vendors: Cloud Foundry Foundation.

Quick answers

Is CVE-2026-41858 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41858 being exploited in the wild.
How severe is CVE-2026-41858?: High severity, with a CVSS score of 7.5, published 4 June 2026.
Which products and versions are affected?: Cloud Foundry Foundation windows-utilities-release versions prior to v0.23.0.
Is there a fix for CVE-2026-41858?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41858 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41858?: Check whether you run Cloud Foundry Foundation Windows Utilities Release. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Get-RandomPassword function in the windows-utilities-release (BOSH-Ecosystem) utilizes a cryptographically weak pseudo-random number generator (PRNG) seeded by the system clock. Because the randomize_password job runs during the boot sequence, the entropy is insufficient, allowing a network-based attacker to estimate the VM boot time and generate a small list of candidate passwords. By brute-forcing this limited set, an attacker can recover the local Administrator credentials, bypassing intended hardening controls. The issue is resolved in version 0.23.0 by implementing a more secure cryptographic primitive.

Affected products

Cloud Foundry Foundation windows-utilities-release versions prior to v0.23.0

Timeline

2026-06-01: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-06-03: disclosed: CVE published to NVD dataset
2026-06-04: other: NVD record updated

References

https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.