This vulnerability (CVE-2026-47830) arises from improper permission settings in the BOSH.Utils.psm1 component of the bosh-windows-stemcell-builder. It permits authenticated users with low privileges to overwrite key service executables located at C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon the next service restart or system reboot, the attacker can escalate privileges to NT AUTHORITY\SYSTEM, effectively gaining full control over the host system. The issue affects all versions of bosh-windows-stemcell-builder prior to v2019.98. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

Exploitation allows low-privilege authenticated users to achieve full system control by overwriting critical service executables and gaining NT AUTHORITY\SYSTEM privileges after a service restart or reboot. This can lead to complete compromise of the affected host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privilege user access to the affected system and monitor for unauthorized modifications to C:\bosh\service_wrapper.exe and C:\bosh\bosh-agent.exe. Consider applying additional access controls or workarounds as recommended by the vendor once available.