CVE-2026-47827: BOSH CLI Tool Command Injection Vulnerability

CVE-2026-47827 Overview

CVE-2026-47827 is a command injection vulnerability [CWE-77] in the Cloud Foundry BOSH command-line interface (CLI) tool on Windows. The flaw allows a remote attacker on an adjacent network to execute arbitrary shell commands through PowerShell command injection. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

The vulnerability affects deployments where operators use the BOSH CLI on Windows workstations to manage Cloud Foundry environments. According to available data, no public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A remote attacker on an adjacent network can execute arbitrary shell commands on Windows systems running the BOSH CLI, leading to full host compromise.

Affected Products

Cloud Foundry BOSH CLI on Windows
Cloud Foundry deployments managed via Windows-based operator workstations
Environments invoking BOSH CLI through PowerShell

Discovery Timeline

2026-08-21 - CVE-2026-47827 published to the National Vulnerability Database (NVD)
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-47827

Vulnerability Analysis

The BOSH CLI on Windows constructs and executes shell commands without properly sanitizing input passed to the underlying PowerShell interpreter. When user-controlled data reaches command execution paths, an attacker can inject additional PowerShell operators or subcommands. The injected content executes with the privileges of the user running the CLI.

Because the BOSH CLI is used to orchestrate large-scale Cloud Foundry deployments, an operator workstation typically holds credentials and network reachability to production infrastructure. Compromise of that workstation gives an attacker a foothold to pivot into managed environments.

Root Cause

The root cause is improper neutralization of special elements used in a command, classified under [CWE-77]. The BOSH CLI passes attacker-influenced strings into PowerShell without escaping metacharacters such as ;, &, |, or backticks. PowerShell interprets these characters as command separators, enabling arbitrary command execution.

Attack Vector

The attack vector is adjacent network with high attack complexity and no privileges or user interaction required. An attacker must be positioned on the same logical network segment as the target Windows host running the BOSH CLI. Exploitation typically requires the attacker to influence data consumed by the CLI, such as manifest content, response payloads, or director metadata that flows through the vulnerable code path.

Refer to the Cloud Foundry Blog Post for detailed technical analysis of the injection path.

Detection Methods for CVE-2026-47827

Indicators of Compromise

Unexpected powershell.exe child processes spawned by the BOSH CLI binary on Windows operator workstations
PowerShell command lines containing shell metacharacters such as ;, &&, or backtick-encoded commands following BOSH CLI invocation
Outbound network connections from operator workstations to unfamiliar hosts shortly after BOSH CLI execution
Creation of new local accounts, scheduled tasks, or persistence artifacts on hosts running the BOSH CLI

Detection Strategies

Baseline the expected process tree for BOSH CLI operations and alert on deviations, particularly unexpected cmd.exe or powershell.exe descendants
Monitor PowerShell script block logging (Event ID 4104) for command patterns originating from BOSH CLI workflows
Correlate BOSH CLI usage with subsequent authentication events to detect lateral movement from compromised operator hosts

Monitoring Recommendations

Enable PowerShell module logging, script block logging, and transcription on all Windows systems that run the BOSH CLI
Forward Sysmon process creation events (Event ID 1) and command-line arguments to a centralized log platform for retrospective search
Track BOSH director API activity for command patterns that could feed injection payloads back to CLI users

How to Mitigate CVE-2026-47827

Immediate Actions Required

Inventory all Windows workstations and CI/CD runners that execute the BOSH CLI and prioritize them for patching
Restrict BOSH CLI usage on Windows until the patched version is deployed, or migrate operators to Linux or macOS hosts
Rotate credentials and API tokens accessible from any Windows host suspected of running an unpatched BOSH CLI

Patch Information

Cloud Foundry has released updated BOSH CLI builds addressing the PowerShell injection issue. Consult the Cloud Foundry Blog Post for the fixed version numbers and download locations, and upgrade all Windows installations of the CLI.

Workarounds

Run the BOSH CLI on Linux or macOS operator workstations where the PowerShell injection path does not apply
Segment operator networks so that adjacent-network attackers cannot reach Windows hosts running the CLI
Enforce least privilege on operator accounts so that a compromised CLI session cannot escalate to broader infrastructure control

bash

# Verify installed BOSH CLI version on Windows (PowerShell)
bosh --version

# Upgrade to the patched release by downloading the fixed binary
# from the official Cloud Foundry releases and replacing the existing bosh.exe