What is the CVSS score of CVE-2026-26334?

CVE-2026-26334 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-26334?

Calero VeraSMART installations contain hardcoded encryption keys that compromise the security of service account credentials stored on affected systems.

How to fix or mitigate CVE-2026-26334?

Within 24 hours: Inventory all VeraSMART deployments and identify systems running versions prior to 2026 R1. Within 7 days: Implement network segmentation to restrict access to VeraSMART servers and rotate all service account credentials used by VeraSMART. Within 30 days: Upgrade to VeraSMART 2026 R1 or later when available, or contact Calero for a timeline and interim security guidance.

Windows CVE-2026-26334

HIGH

Use of Hard-coded Credentials (CWE-798)

2026-02-13 disclosure@vulncheck.com

Windows Privilege Escalation Verasmart Calero

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 13, 2026 - 21:16 nvd

HIGH 7.8

DescriptionCVE.org

Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the system can extract the hardcoded keys from the Veramark.Framework.dll module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially resulting in local privilege escalation depending on the privileges of the configured service account.

AnalysisAI

Local privilege escalation in Calero VeraSMART versions before 2026 R1 stems from hardcoded AES encryption keys embedded in Veramark.Framework.dll that protect service account credentials stored in app.settings. An attacker with local system access can extract these static keys, decrypt the stored passwords, and use the recovered credentials to authenticate as the service account, potentially gaining elevated privileges depending on that account's permissions. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-798 (Use of Hard-coded Credentials). Affects Verasmart. Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the system can extract the hardcoded keys from the Veramark.Framework.dll module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially