CVE-2026-26335 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE
Attackers with static machine keys can craft ViewState payloads to trigger deserialization and achieve remote code execution on VeraSMART servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26335?
CVE-2026-26335 is a critical unsafe deserialization vulnerability in Calero VeraSMART, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.
Weakness: CWE-321
Which versions are affected by CVE-2026-26335?
It affects 1 product.
Products include Calero Verasmart.
How do I fix CVE-2026-26335?
No fix has been published for CVE-2026-26335 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-26335 being exploited?
There is no known exploitation of CVE-2026-26335 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Calero VeraSMART
Sources
Also known as GHSA-pw8j-97jq-cw6g.