CVE-2026-26335 - Vulnerability Analysis

Overview

Calero VeraSMART versions prior to 2022 R1 contain a server-side deserialization vulnerability caused by static ASP.NET/IIS machineKey values in web.config, letting attackers craft valid ViewState payloads for remote code execution, exploit requires attacker to obtain machineKey values.

Severity & Score

Impact

Attackers can execute arbitrary code remotely in the IIS application context, potentially compromising the entire server.

Mitigation

Update to version 2022 R1 or later.

References

• https://www.calero.com/
• https://www.vulncheck.com/advisories/calero-verasmart-2022-r1-static-iis-machine-keys-enable-viewstate-rce

Social Media Activity(1 post)

Offensive Sequence

@offseq

Feb 14, 2026

CVE-2026-26335 (CRITICAL, CVSS 9.3): Calero VeraSMART <2022 R1 uses hard-coded crypto keys, enabling unauth RCE via crafted ViewState in ASP.NET. No exploits yet, but immediate upgrade or key rotation essential! https://radar.offseq.com/threat/cve-2026-26335-cwe-321-use-of-hard-coded-cryptogra-07023d75 #OffSeq #Vulnerability #Calero #RCE

View original post

GitHub Repositories(1 repo)

• https://github.com/mbanyamer/CVE-2026-26335-Calero-VeraSMART-RCE

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner