Armatura One CVE-2026-94591

Exploitation requires that the optional credential-encryption protection be enabled so credentials are stored AES-128-CBC-encrypted in the install configuration file, and that the attacker (1) possess a copy of the Armatura One installation package to recover the universal embedded key and IV, and (2) separately obtain the specific target installation's encrypted configuration file. The limiting factor is this second prerequisite: the flaw grants no remote network access by itself (AV:L) - the attacker must already have a path to read the victim's config file (local/filesystem access, a stolen backup, or an exposed share) before the hardcoded key yields the plaintext database and message-broker credentials.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 8.6) correctly reflects a local attack vector: although privileges are not required (PR:N), successful exploitation hinges on the attacker first obtaining a copy of a target installation's encrypted configuration file plus the installation package - this is not remotely triggerable, which materially lowers real-world urgency relative to the 8.6 headline. CWE-321 (hard-coded cryptographic key) is confirmed by the description, which states the AES-128-CBC key and IV are fixed, embedded in the software, and identical across every installation. No EPSS score, CISA KEV listing, or public POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis,' so there is no evidence of active or automatable exploitation. The high confidentiality/integrity/availability impact is plausible because recovered database and message-broker credentials could grant broad backend access, but the impact is conditional on separately exfiltrating the config file - a prerequisite the CVSS vector captures as AV:L rather than AV:N. Net: this is a genuine, well-characterized cryptographic weakness worth remediating, but the local/precondition-dependent exploitation path makes it a targeted rather than mass-exploitation risk, not a drop-everything network-facing threat.

An attacker downloads the publicly or commercially available Armatura One installation package and statically extracts the embedded, universal AES-128-CBC key and initialization vector. Having separately obtained a specific victim's encrypted install configuration file (e.g., via filesystem access, a backup, or a misconfigured share), the attacker decrypts it offline to recover the plaintext database and message-broker credentials. No public exploit code is identified at time of analysis, but the attack requires only standard reverse-engineering effort (AC:L).