CVE-2026-26335 PUBLISHED

Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

Assigner: VulnCheck
Reserved: 13.02.2026 Published: 13.02.2026 Updated: 13.02.2026

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Calero
Product	VeraSMART
Versions	Default: unaffected affected from 0 to 2022 R1 (excl.)

Credits

Victor A. Morales, Senior Pentester Team Leader, GM SecTec Inc. finder
Jan A. Rodriguez, Pentester Jr., GM SecTec Inc. finder

References

Problem Types

CWE-321 Use of Hard-coded Cryptographic Key CWE