PT-2026-8032 · Veramark · Verasmart

Gm Sectec Inc + 2 · Publicado 2026-02-13 · Atualizado 2026-02-14 · CVE-2026-26335

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Calero VeraSMART versions prior to 2022 R1

Description The application uses static machineKey values configured for the VeraSMART web application and stored in 'C:Program Files (x86)VeramarkVeraSMARTWebRootweb.config'. An attacker obtaining these keys can create a valid ASP.NET ViewState payload, bypassing integrity validation. This leads to server-side deserialization and remote code execution within the IIS application context.

Recommendations Update to version 2022 R1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-321

Identificadores relacionados

CVE-2026-26335

Produtos afetados

Verasmart

Referências · 7

• https://calero.com · Nota
• https://vulncheck.com/advisories/calero-verasmart-2022-r1-static-iis-machine-keys-enable-viewstate-rce · Nota
• https://t.me/CVEtracker/44661 · Publicação no Telegram
• https://twitter.com/offseq/status/2022506128601415948 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26335 · Nota de Segurança
• https://twitter.com/CVEnew/status/2022428988376043863 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26335 · Aviso do Fabricante