Read the docs
TI-2026-21289 Aliases CVE-2026-26333GHSA-m4w4-g5c5-j4f4

Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE

Priority MEDIUM 51CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-502.

Summary

Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An unauthenticated remote attacker can invoke the exposed remoting endpoints to perform arbitrary file read and write operations via the WebClient class. This allows retrieval of sensitive files such as WebRoot\\web.config, which may disclose IIS machineKey validation and decryption keys. An attacker can use these keys to generate a malicious ASP.NET ViewState payload and achieve remote code execution within the IIS application context. Additionally, supplying a UNC path can trigger outbound SMB authentication from the service account, potentially exposing NTLMv2 hashes for relay or offline cracking.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0107 65th percentileScored 2026-11-07
Fix Fixed VeraSMART (Calero): 2022 R1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CaleroVeraSMARTbefore 2022 R12022 R1Patch availableCNA
  • VeraSMART VendorCalero Affected before 2022 R1 Fixed in 2022 R1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:*before 2022.0VulnerableCalero
cpe:2.3:a:calero:verasmart:2022.0:-:*:*:*:*:*:*2022.0VulnerableCalero
  • cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:* Versions before 2022.0 Vulnerable ·Calero
  • cpe:2.3:a:calero:verasmart:2022.0:-:*:*:*:*:*:* Versions 2022.0 Vulnerable ·Calero

Remediation

  • Fix · CNA VeraSMART (Calero) Fixed in 2022 R1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Calero VeraSMART 2022 R1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-21291 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEPriority MEDIUM 54
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26333
  2. 2026-10-03 Alias added: GHSA-m4w4-g5c5-j4f4

References

Other 1

  • TI-2026-21291 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-21290 Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences