Read the docs
TI-2026-21291 Aliases CVE-2026-26335GHSA-pw8j-97jq-cw6g

Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

Priority MEDIUM 54CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02996 87th percentileScored 2026-11-07
Fix Fixed VeraSMART (Calero): 2022 R1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CaleroVeraSMARTbefore 2022 R12022 R1Patch availableCNA
  • VeraSMART VendorCalero Affected before 2022 R1 Fixed in 2022 R1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:*before 2022.0VulnerableCalero
cpe:2.3:a:calero:verasmart:2022.0:-:*:*:*:*:*:*2022.0VulnerableCalero
  • cpe:2.3:a:calero:verasmart:*:*:*:*:*:*:*:* Versions before 2022.0 Vulnerable ·Calero
  • cpe:2.3:a:calero:verasmart:2022.0:-:*:*:*:*:*:* Versions 2022.0 Vulnerable ·Calero

Remediation

  • Fix · CNA VeraSMART (Calero) Fixed in 2022 R1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Calero VeraSMART 2022 R1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-21289 Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCEPriority MEDIUM 51
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26335
  2. 2026-10-03 Alias added: GHSA-pw8j-97jq-cw6g

References

Other 1

  • TI-2026-21289 Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE CVSS 4.0CRITICAL 10.0
  • TI-2026-21290 Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences