CVE-2026-26334Disclosure(calero / verasmart)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the system can extract the hardcoded keys from the Veramark.Framework.dll module and decrypt the stored credentials. The recovered credentials can then be used to authenticate to the Windows host, potentially resulting in local privilege escalation depending on the privileges of the configured service account.

calero CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/calero-verasmart-2026-r1-hardcoded-static-aes-keys-allow-decryption-of-service-credentials

Other references

https://www.calero.com/

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

verasmart

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-13); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

calero

Products

verasmart

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew237d
Disclosure
CVE-2026-26334 Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are use… https://www.cve.org/CVERecord?id=CVE-2026-26334
Post summary
The CVE discloses that earlier versions of Calero VeraSMART contain hardcoded static AES keys, highlighting a potential security weakness, with no PoC, exploit, patch, or active exploitation details provided.
00020208
56.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds237d
Disclosure
CVE-2026-26334 Hardcoded AES Keys in Calero VeraSMART Expose Service Account Credentials https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26334
Post summary
CVE-2026-26334 concerns hardcoded AES keys in Calero VeraSMART that expose service account credentials; the brief announcement lacks PoC, exploit, patch, or active exploitation details.
0000043
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	calero	verasmart	-	-	-
App	calero	verasmart	2026.0	-	-

Explore more

Back to dashboard calero CVEs verasmart vulnerabilities