CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control. Affected versions: - windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later

• CWE-338

• https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41852A vulnerability in Spring Expression Language (SpEL) evaluat…5.3
• CVE-2026-41853Spring MVC and WebFlux applications are vulnerable to Multip…5.3
• CVE-2026-41854Due to incorrect host parsing, applications that rely on Uri…6.5
• CVE-2026-41855In an untrusted JMS environment, org.springframework.jms.sup…9.8
• CVE-2026-41856The Spring GraphQL annotation detection mechanism for @Contr…7.5
• CVE-2026-41857A compromised or malicious BOSH Director can execute arbitra…7.8
• CVE-2026-41859A network man-in-the-middle between nats-sync and the BOSH d…7.8
• CVE-2026-4186A vulnerability was determined in UEditor up to 1.4.3.2. Thi…3.5
• CVE-2026-41860CWE-326 in BOSH allows a local attacker to steal Basic-auth …8.8
• CVE-2026-41861Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metad…4.2
• CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, …8.8
• CVE-2026-41863Spring AI's support for Anthropic's Skills API used LLM-infl…6.5