« Volver al listado

CVE-2026-41858

Estado: Pendiente de análisisAlta (7.5)—

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.

Leer descripción completaMostrar menos

Affected versions: - windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto sin autenticación (AV:N, PR:N, UI:N) para recuperar credenciales de administrador explotando PRNG predecible en función criptográfica (CWE-338) que genera la contraseña de hardening del administrador local.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkVulnerability ScanningUser Account ManagementPassword Policies

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bosh-ecosystem — Windows Utilities ReleaseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41858",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41858",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-04T14:21:35.417546Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Cloud Foundry Foundation",
          "product": "windows-utilities-release",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.23.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-04T03:16:19.790",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later"
    },
    {
      "lang": "es",
      "value": "Aleatoriedad débil / Primitiva criptográfica insegura (CWE-338) en Get-RandomPassword en BOSH-Ecosystem / windows-utilities-release permite a un atacante de red estimar el tiempo de arranque de la VM y reconstruir una pequeña lista de candidatos para recuperar la contraseña de Administrador. El trabajo randomize_password existe únicamente para bloquear la cuenta de Administrador local con una contraseña imposible de adivinar como un control de endurecimiento. Debido a que la contraseña se deriva de un PRNG predecible, sembrado por reloj, un atacante de red que puede estimar el tiempo de arranque de la VM puede reconstruir una pequeña lista de candidatos y recuperar la contraseña de Administrador, lo que anula el control de endurecimiento.\n\nVersiones afectadas:\n- windows-utilities-release: todas las versiones anteriores a v0.23.0 (inclusive); corregido en v0.23.0 o posterior"
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "security@vmware.com"
}