Executive brief
A security flaw in the BOSH Windows stemcell builder allows users with low-level access to take full control of a Windows server. By exploiting incorrect file permissions, an attacker can replace critical system files with malicious ones. When the system or its services restart, the malicious code runs with the highest possible administrative privileges (SYSTEM), potentially leading to data theft or complete service disruption.
Technical details
A local privilege escalation vulnerability exists in the BOSH.Utils.psm1 component of the bosh-windows-stemcell-builder. The root cause is an incorrect permission assignment (CWE-211) that allows low-privileged authenticated users to overwrite the 'C:\bosh\service_wrapper.exe' or 'C:\bosh\bosh-agent.exe' binaries. An attacker can exploit this by replacing these files with a malicious executable; when the BOSH agent service restarts or the host reboots, the malicious code executes with NT AUTHORITY\SYSTEM privileges. This vulnerability is addressed in version v2019.98.
Affected products
- Cloud Foundry Foundation bosh-windows-stemcell-builder versions prior to v2019.98
Timeline
- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD dataset