What is the CVSS score of CVE-2026-26335?

CVE-2026-26335 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-26335?

Yes, a public proof-of-concept exploit is available for CVE-2026-26335. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26335?

Within 24 hours: Identify and inventory all VeraSMART deployments and versions in your environment; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict access to VeraSMART web applications; enable detailed logging and monitoring for suspicious authentication and data access patterns; begin testing upgrade path to VeraSMART 2022 R1 or later in a non-production environment. Within 30 days: Complete upgrade of all VeraSMART instances to version 2022 R1 or later; rotate all credentials and session tokens associated with affected systems; conduct forensic analysis for signs of exploitation.

Verasmart CVE-2026-26335

CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-02-13 disclosure@vulncheck.com

RCE Deserialization .NET IIS Verasmart Calero

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain static machineKey from web.config
Delivery

Craft malicious ASP.NET ViewState payload
Exploit

Submit payload to application
Execution

Trigger unsafe deserialization
Impact

Execute arbitrary code as IIS user

Vulnerability Assessment

Weakness	CWE CWE-321 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Key management, no hard-coded keys
Exploitation Conditions	Static machineKey values in C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config must be accessible to attacker. Applies to Calero VeraSMART versions prior to 2022 R1 with default IIS deployment accepting ViewState payloads.
Impact	CVSS 9.8. Known machineKey allows forging authentication cookies and exploiting ViewState deserialization.
Exploit ScenarioDerived	Attacker uses known machineKey to craft malicious ViewState payload, achieving RCE through deserialization.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks and cookie forgery.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 9.8

Static machineKey in Calero VeraSMART web application.

RemediationAI

Update to 2022 R1. Rotate machineKey values.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-321 hardcoded cryptographic key. Static ASP.NET machineKey enables ViewState deserialization attacks.

Know when Verasmart gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

Executive ViewAI

Why It Matters

Calero VeraSMART installations are vulnerable to critical cryptographic key compromise due to hardcoded static encryption keys in configuration files. Attackers can decrypt sensitive data, forge authentication tokens, and gain unauthorized access to the application without a vendor patch being available. This affects all organizations running VeraSMART versions prior to 2022 R1 and requires immediate mitigation.

Business Impact: Severe

Compensating Controls

Implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting VeraSMART authentication mechanisms; restrict network access to VeraSMART web application through firewall rules and VPN requirements; disable remote access to VeraSMART if not operationally required; enforce multi-factor authentication at the network perimeter; increase monitoring and alerting on authentication failures and cryptographic-related system events; apply OS-level access controls to restrict read permissions on web.config files to minimize key exposure risk.

Threat Intelligence Overview

EPSS Score

0.1%

Top 70% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

Exploit-DB

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.