Our takeCISA reports active exploitation of Armatura One vulnerabilities (CVEs 2023-46604 and 2026-94591) allowing database access, arbitrary code execution as highest privilege, or full control of the physical access-control system. Versions below 4.7.2 are affected; update immediately if you run this yourself.Cyber Resilience desk
Sources (1)
- cisa_ics · cisa_ics
What this means for you — Security leader:CISA reports active exploitation of two vulnerabilities in Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591) that can lead to database compromise, arbitrary code execution as root, or full control of the physical access-control system. Patch to 4.7.2 or later immediately if you use this ICS product.
What this means for you — Lean IT orgs:If your building uses Armatura One for physical access control, check the version today and update to 4.7.2 or newer. An attacker who reaches it can take over doors, readers, and the database.
What this means for you — MSP:Audit every client running Armatura One physical access control systems. Confirm version is at or above 4.7.2; CISA states these two flaws are under active exploitation and enable full system takeover.
What this means for you — Researcher:CISA advisory ICSA-26-274-01 details two actively exploited vulnerabilities in Armatura One <4.7.2 allowing unauthorized database access, root-level code execution, and physical access-control takeover. Update to 4.7.2+.