CVE-2026-26335
Published: 13 February 2026
Description
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity…
more
validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.
Mitigating Controls (NIST 800-53 r5)AI
Establishes and manages cryptographic keys securely, directly preventing the use of static, hard-coded machineKey values in web.config that enable ViewState integrity bypass and deserialization RCE.
Enforces secure configuration settings for applications like VeraSMART, ensuring machineKey values in web.config are not static or predictable.
Requires timely flaw remediation through patching to versions like 2022 R1, which eliminates static keys and mitigates the deserialization RCE vulnerability.
Security SummaryAI
CVE-2026-26335 is a critical vulnerability in Calero VeraSMART versions prior to 2022 R1, stemming from the use of static ASP.NET/IIS machineKey values configured for the VeraSMART web application. These keys are stored in the file C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config. The issue, classified under CWE-321 (Use of Hard-coded Cryptographic Key), allows an attacker who obtains these keys to craft ASP.NET ViewState payloads that pass integrity validation, resulting in server-side deserialization and remote code execution within the context of the IIS application. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-13.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction. By acquiring the static machine keys—potentially through access to the web.config file or knowledge of their hardcoded values—the attacker constructs a valid ViewState payload tailored to trigger deserialization gadgets, achieving arbitrary remote code execution on the affected IIS server.
Advisories, including those from VulnCheck at https://www.vulncheck.com/advisories/calero-verasmart-2022-r1-static-iis-machine-keys-enable-viewstate-rce and the vendor site at https://www.calero.com/, highlight that Calero VeraSMART 2022 R1 addresses the issue by moving away from static keys, serving as the primary mitigation through upgrade.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote, unauthenticated exploitation of a public-facing ASP.NET/IIS web application through static machineKey values allowing crafted ViewState deserialization for RCE, directly mapping to T1190: Exploit Public-Facing Application.