Home

Description

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

PUBLISHED Reserved 2026-02-13 | Published 2026-02-13 | Updated 2026-02-18 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-321 Use of Hard-coded Cryptographic Key

Product status

Default status
unaffected

Any version before 2022 R1
affected

Credits

Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp. finder

Jan A. Rodriguez, Pentester Jr., GM Sectec, Corp. finder

References

www.calero.com/ product

www.vulncheck.com/...c-iis-machine-keys-enable-viewstate-rce third-party-advisory

cve.org (CVE-2026-26335)

nvd.nist.gov (CVE-2026-26335)

Download JSON