This vulnerability (CVE-2026-47830) arises from improper permission settings in the BOSH.Utils.psm1 script within the bosh-windows-stemcell-builder project. Low-privilege authenticated users can overwrite key service executables located at C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon the next service restart or system reboot, the attacker gains SYSTEM-level privileges, effectively compromising the host. The issue affects versions prior to 2019.98. The CVSS 4.0 base score is 8.5, reflecting high severity with local attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently provided.

Successful exploitation allows an authenticated user with low privileges to overwrite critical service executables, leading to full system compromise with NT AUTHORITY\SYSTEM privileges after a service restart or reboot. This results in complete control over the affected host, posing a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for unauthorized modifications to the affected executables. Consider applying additional access controls or temporary workarounds if recommended by the vendor.