Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-26335 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Calero Verasmart. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-26335 is a critical vulnerability in Calero VeraSMART versions prior to 2022 R1, stemming from the use of static ASP.NET/IIS machineKey values configured for the VeraSMART web application. These keys are stored in the file C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config. The issue, classified under CWE-321 (Use of Hard-coded Cryptographic Key), allows an attacker who obtains these keys to craft ASP.NET ViewState payloads that pass integrity validation, resulting in server-side deserialization and remote code execution within the context of the IIS application. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-13.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction. By acquiring the static machine keys—potentially through access to the web.config file or knowledge of their hardcoded values—the attacker constructs a valid ViewState payload tailored to trigger deserialization gadgets, achieving arbitrary remote code execution on the affected IIS server.
Advisories, including those from VulnCheck at https://www.vulncheck.com/advisories/calero-verasmart-2022-r1-static-iis-machine-keys-enable-viewstate-rce and the vendor site at https://www.calero.com/, highlight that Calero VeraSMART 2022 R1 addresses the issue by moving away from static keys, serving as the primary mitigation through upgrade.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7363
Vulnerability Data
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity…
more
validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.