The vulnerability CVE-2026-47831 affects bosh-windows-stemcell-builder versions before 2019.98. It arises from the use of a cryptographically weak pseudo-random number generator (PRNG) in the GenerateRandomPassword function. This weakness reduces the entropy of generated passwords, enabling a remote attacker to perform brute-force attacks against SSH logins on TCP port 22. The CVSS 4.0 score is 7.7, indicating high severity with attack vector being adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

The use of a weak PRNG in password generation significantly lowers the security of SSH authentication, allowing remote attackers to brute-force SSH logins. Successful exploitation could lead to unauthorized access, compromising confidentiality, integrity, and availability of affected systems running vulnerable versions of bosh-windows-stemcell-builder.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting SSH access to trusted networks and implementing additional authentication controls where possible.