CVE-2026-41858

Name of the Vulnerable Software and Affected Versions windows-utilities-release versions prior to 0.23.0

Description The Get-RandomPassword function in the randomize password job uses a predictable, clock-seeded Pseudo-Random Number Generator (PRNG), which is an algorithm for generating a sequence of numbers that approximates the properties of true randomness. This allows a network attacker to estimate the VM boot time and reconstruct a small candidate list to recover the Administrator password, bypassing the hardening control intended to secure the local Administrator account.

Recommendations Update to version 0.23.0 or later.