Read the docs
TI-2026-21290 Aliases CVE-2026-26334GHSA-cxch-rc9p-q6hq

Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials

Priority LOW 37CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the system can extract the hardcoded keys from the Veramark.Framework.dll module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially resulting in local privilege escalation depending on the privileges of the configured service account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00094 0th percentileScored 2026-11-07
Fix Fixed VeraSMART (Calero): 2026 R1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CaleroVeraSMARTbefore 2026 R12026 R1Patch availableCNA
  • VeraSMART VendorCalero Affected before 2026 R1 Fixed in 2026 R1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:*before 2026.0VulnerableCalero
cpe:2.3:a:calero:verasmart:2026.0:-:*:*:*:*:*:*2026.0VulnerableCalero
  • cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:* Versions before 2026.0 Vulnerable ·Calero
  • cpe:2.3:a:calero:verasmart:2026.0:-:*:*:*:*:*:* Versions 2026.0 Vulnerable ·Calero

Remediation

  • Fix · CNA VeraSMART (Calero) Fixed in 2026 R1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26334
  2. 2026-10-03 Alias added: GHSA-cxch-rc9p-q6hq

References

Other 1

  • TI-2026-21291 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-21289 Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE CVSS 4.0CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences