CVE-2026-47830: BOSH Windows Privilege Escalation Flaw

CVE-2026-47830 Overview

CVE-2026-47830 is an incorrect permission assignment vulnerability in the BOSH.Utils.psm1 PowerShell module shipped with the BOSH-Ecosystem bosh-windows-stemcell-builder. The flaw grants overly permissive write access to files under C:\bosh\, allowing low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. On the next service restart or system reboot, Windows executes the replaced binary as NT AUTHORITY\SYSTEM, giving the attacker full control of the host. Affected releases include all bosh-windows-stemcell-builder versions prior to v2019.98.

Critical Impact
Any authenticated local user can escalate to SYSTEM by overwriting BOSH agent executables, resulting in full host takeover of Windows stemcell instances.

Affected Products

BOSH-Ecosystem bosh-windows-stemcell-builder versions prior to v2019.98
Windows stemcells produced by affected builder versions containing C:\bosh\service_wrapper.exe
Windows stemcells containing C:\bosh\bosh-agent.exe with weak ACLs

Discovery Timeline

2026-07-09 - CVE-2026-47830 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-47830

Vulnerability Analysis

The vulnerability is a local privilege escalation caused by insecure filesystem permissions [CWE-732]. The BOSH.Utils.psm1 module used during stemcell construction creates the C:\bosh\ directory and places privileged service binaries inside without restricting write access. Standard authenticated users inherit modify rights on files including service_wrapper.exe and bosh-agent.exe.

Because both executables run as Windows services under the LocalSystem account, replacing them with attacker-controlled content produces immediate code execution at SYSTEM integrity on the next service start or host reboot. The attack requires only local logon and low privileges.

Root Cause

The stemcell builder generates directory and file ACLs that do not remove inherited write permissions for non-privileged principals. BOSH.Utils.psm1 does not apply a restrictive ACL to the C:\bosh tree, leaving service executables writable by low-privileged users.

Attack Vector

An attacker with authenticated local access to a Windows BOSH-managed instance writes a malicious payload over C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. When the service manager restarts the BOSH agent, or the host reboots, Windows launches the attacker binary under NT AUTHORITY\SYSTEM. The attacker then executes arbitrary commands, installs persistence, or pivots into the wider Cloud Foundry environment.

No exploitation in the wild has been reported and no public proof-of-concept is currently listed. Refer to the Cloud Foundry advisory for vendor technical details.

Detection Methods for CVE-2026-47830

Indicators of Compromise

Unexpected modifications to C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe, especially by non-administrative users.
Digital signature mismatches or missing signatures on BOSH agent binaries after deployment.
New child processes spawned by service_wrapper.exe running under NT AUTHORITY\SYSTEM that do not match known BOSH agent behavior.

Detection Strategies

Audit ACLs on C:\bosh\ and its executables using icacls C:\bosh to identify write permissions granted to Users, Authenticated Users, or other low-privilege principals.
Enable Windows object access auditing (Event ID 4663) on the C:\bosh directory to record write attempts against service binaries.
Hash-baseline the BOSH executables at deployment time and compare periodically to detect unauthorized replacement.

Monitoring Recommendations

Forward Windows Security and Sysmon FileCreate and FileCreateStreamHash events for C:\bosh\*.exe to a centralized log platform for correlation.
Alert on service configuration changes (Event ID 7040) and unexpected service restarts of the BOSH agent.
Monitor for SYSTEM-level process creation whose parent chain traces to a modified service_wrapper.exe.

How to Mitigate CVE-2026-47830

Immediate Actions Required

Upgrade bosh-windows-stemcell-builder to v2019.98 or later and rebuild any Windows stemcells produced by earlier versions.
Redeploy Windows VMs using the patched stemcell so existing hosts no longer carry weak ACLs on C:\bosh\.
Restrict interactive and remote logon on BOSH-managed Windows hosts to trusted administrative accounts until remediation is complete.

Patch Information

The fix is included in bosh-windows-stemcell-builderv2019.98. The patched builder applies restrictive ACLs to C:\bosh\ so only privileged accounts can modify service executables. Full remediation guidance is available in the Cloud Foundry advisory.

Workarounds

Manually apply restrictive ACLs on affected hosts, granting write access to C:\bosh\ only to SYSTEM and Administrators and removing inherited permissions for Users and Authenticated Users.
Enforce application allow-listing (Windows Defender Application Control or AppLocker) so unsigned or unexpected binaries at C:\bosh\service_wrapper.exe and C:\bosh\bosh-agent.exe cannot execute.
Limit local logon rights on Windows stemcell instances to reduce the pool of accounts capable of triggering the flaw.

bash

# Configuration example: restrict ACLs on C:\bosh (run as Administrator)
icacls "C:\bosh" /inheritance:r
icacls "C:\bosh" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\bosh" /remove "BUILTIN\Users" "NT AUTHORITY\Authenticated Users"