CVE-2026-41858

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41858", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-04-22T06:22:10.082Z", "datePublished": "2026-06-04T02:10:34.656Z", "dateUpdated": "2026-06-04T15:07:20.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-04T02:10:34.656Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)", "cweId": "CWE-338", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "A network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Windows Administrator password, defeating the hardening control (confidentiality impact: HIGH; integrity and availability unaffected)."}]}], "affected": [{"vendor": "Cloud Foundry Foundation", "product": "windows-utilities-release", "versions": [{"status": "affected", "version": "0", "lessThan": "0.23.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later"}]}], "references": [{"url": "https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T14:21:35.417546Z", "id": "CVE-2026-41858", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T15:07:20.434Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:21:35.417546Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:21:39.518Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "A network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Windows Administrator password, defeating the hardening control (confidentiality impact: HIGH; integrity and availability unaffected)."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Cloud Foundry Foundation", "product": "windows-utilities-release", "versions": [{"status": "affected", "version": "0", "lessThan": "0.23.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later", "supportingMedia": [{"type": "text/html", "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-04T02:10:34.656Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41858", "state": "PUBLISHED", "dateUpdated": "2026-06-04T15:07:20.434Z", "dateReserved": "2026-04-22T06:22:10.082Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-06-04T02:10:34.656Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "windows-utilities-release", "vendor": "Cloud Foundry Foundation", "versions": [{"lessThan": "0.23.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Because the password is derived from a predictable, clock-seeded PRNG, a network attacker who can estimate VM boot time can reconstruct a small candidate list and recover the Administrator password, defeating the hardening control.\n\nAffected versions:\n- windows-utilities-release: all versions prior to v0.23.0 (inclusive); fixed in v0.23.0 or later"}, {"lang": "es", "value": "Aleatoriedad d\u00e9bil / Primitiva criptogr\u00e1fica insegura (CWE-338) en Get-RandomPassword en BOSH-Ecosystem / windows-utilities-release permite a un atacante de red estimar el tiempo de arranque de la VM y reconstruir una peque\u00f1a lista de candidatos para recuperar la contrase\u00f1a de Administrador. El trabajo randomize_password existe \u00fanicamente para bloquear la cuenta de Administrador local con una contrase\u00f1a imposible de adivinar como un control de endurecimiento. Debido a que la contrase\u00f1a se deriva de un PRNG predecible, sembrado por reloj, un atacante de red que puede estimar el tiempo de arranque de la VM puede reconstruir una peque\u00f1a lista de candidatos y recuperar la contrase\u00f1a de Administrador, lo que anula el control de endurecimiento.\n\nVersiones afectadas:\n- windows-utilities-release: todas las versiones anteriores a v0.23.0 (inclusive); corregido en v0.23.0 o posterior"}], "id": "CVE-2026-41858", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41858", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T14:21:35.417546Z", "version": "2.0.3"}}]}, "published": "2026-06-04T03:16:19.790", "references": [{"source": "security@vmware.com", "url": "https://www.cloudfoundry.org/blog/cve-2026-41858-brute-forceable-windows-admin-creds/"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "windows-utilities-release", "source": "cna", "vendor": "Cloud Foundry Foundation"}, "product": "windows-utilities-release", "vendor": "cloud_foundry_foundation"}], "created": "2026-06-04T03:30:04.168971+00:00", "title": "Weak Randomness Allows Brute\u2011Force Recovery of Windows Administrator Password", "updated": "2026-06-05T10:09:21.053283+00:00", "vendors": ["cloud_foundry_foundation", "cloud_foundry_foundation$PRODUCT$windows-utilities-release"]}