Is CVE-2026-47830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47830 being exploited in the wild.

How severe is CVE-2026-47830?

High severity, with a CVSS score of 8.8, published 9 July 2026.

Which products and versions are affected?

Cloud Foundry Foundation Bosh-Windows-Stemcell-Builder versions prior to v2019.98.

Is there a fix for CVE-2026-47830?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47830 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47830?

Check whether you run Cloud Foundry Foundation Bosh-Windows-Stemcell-Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47830: Cloud Foundry BOSH stemcell builder privilege escalation in BOSH.Utils.psm1

CVE-2026-47830 · Severity: high · CVSS 8.8 · Published 2026-07-09

A security flaw in the BOSH Windows stemcell builder allows users with low-level access to take full control of a Windows server. By exploiting incorrect file permissions, an attacker can replace critical system files with malicious ones. When the system or its services restart, the malicious code runs with the highest possible administrative privileges (SYSTEM), potentially leading to data theft or complete service disruption.

Vendors: Cloud Foundry Foundation.

Quick answers

Is CVE-2026-47830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47830 being exploited in the wild.
How severe is CVE-2026-47830?: High severity, with a CVSS score of 8.8, published 9 July 2026.
Which products and versions are affected?: Cloud Foundry Foundation Bosh-Windows-Stemcell-Builder versions prior to v2019.98.
Is there a fix for CVE-2026-47830?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47830 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47830?: Check whether you run Cloud Foundry Foundation Bosh-Windows-Stemcell-Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in the BOSH.Utils.psm1 component of the bosh-windows-stemcell-builder. The root cause is an incorrect permission assignment (CWE-211) that allows low-privileged authenticated users to overwrite the 'C:\bosh\service_wrapper.exe' or 'C:\bosh\bosh-agent.exe' binaries. An attacker can exploit this by replacing these files with a malicious executable; when the BOSH agent service restarts or the host reboots, the malicious code executes with NT AUTHORITY\SYSTEM privileges. This vulnerability is addressed in version v2019.98.

Affected products

Cloud Foundry Foundation bosh-windows-stemcell-builder versions prior to v2019.98

Timeline

2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-07-09: disclosed: CVE published to NVD dataset

References

https://www.cloudfoundry.org/blog/cve-2026-47830-incorrect-permission-assignment-allows-local-privilege-escalation-to-system-via-executable-overwrite/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.