TI-2026-30268 Aliases CVE-2026-41858 GHSA-f9p6-prpf-3757

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in…

LOW 34CWE-338Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control. Affected versions: - windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00245 15th percentileScored 2026-11-07

Fix Fixed windows-utilities-release (Cloud Foundry Foundation): 0.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloud Foundry Foundation	windows-utilities-release	before 0.23.0	0.23.0	Patch available	CNA

windows-utilities-release VendorCloud Foundry Foundation Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA

Remediation

Fix · CNA windows-utilities-release (Cloud Foundry Foundation) Fixed in 0.23.0

Timeline

2026-10-02 Threatist record created from CVE-2026-41858
2026-10-03 Alias added: GHSA-f9p6-prpf-3757

References

Other 1

https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/

TI-2026-29616 Information disclosure in Cloud Foundry Foundation uaa_release CVSS 4.0CRITICAL 10.0
TI-2026-35291 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVSS 4.0CRITICAL 9.2
TI-2026-29615 Improper authentication in Cloud Foundry Foundation log-cache_release CVSS 3.1HIGH 7.5
TI-2026-35283 Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite CVSS 4.0HIGH 8.5
TI-2026-35280 CVE-2026-47827 – BOSH CLI Powershell Injection CVSS 3.1HIGH 7.5
TI-2026-29662 OS command injection in Cloud Foundry Foundation BOSH CVSS 4.0HIGH 8.7

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences