CVE-2026-26335: Calero VeraSMART RCE Vulnerability

CVE-2026-26335 Overview

CVE-2026-26335 is a critical insecure deserialization vulnerability affecting Calero VeraSMART versions prior to 2022 R1. The vulnerability stems from the use of static ASP.NET/IIS machineKey values configured for the VeraSMART web application. These keys are stored in C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

Critical Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server with the privileges of the IIS application pool, potentially leading to complete system compromise.

Affected Products

• Calero VeraSMART versions prior to 2022 R1

Discovery Timeline

• 2026-02-13 - CVE-2026-26335 published to NVD
• 2026-02-13 - Last updated in NVD database

Technical Details for CVE-2026-26335

Vulnerability Analysis

This vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key), which occurs when cryptographic keys are embedded directly in application code or configuration files rather than being generated dynamically or stored securely. The hardcoded machineKey values in the web.config file allow attackers to forge valid ViewState payloads.

ASP.NET ViewState is a mechanism used to preserve page and control state across postbacks. The machineKey configuration determines how ViewState data is encrypted and validated. When static keys are used across installations, any attacker who discovers these keys—whether through source code access, configuration file disclosure, or reverse engineering—can craft malicious ViewState payloads that the application will trust and deserialize.

The network-accessible nature of this vulnerability combined with no required authentication or user interaction makes it highly exploitable. Once an attacker has the static machineKey values, they can leverage tools like ysoserial.net to generate serialized payloads containing malicious gadget chains that execute arbitrary commands upon deserialization.

Root Cause

The root cause of CVE-2026-26335 is the use of static, hardcoded ASP.NET machineKey values in the VeraSMART web application configuration. These cryptographic keys are used for ViewState encryption and validation but are identical across all VeraSMART installations prior to version 2022 R1. This violates fundamental cryptographic principles where unique keys should be generated per deployment to prevent key disclosure from compromising all installations.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker with knowledge of the static machineKey values can craft a malicious ASP.NET ViewState payload containing a serialized .NET object that triggers code execution upon deserialization. This payload can be submitted via HTTP POST requests to any page in the VeraSMART web application that processes ViewState data.

The exploitation flow typically involves:

1. Obtaining the static machineKey values from the known configuration file path or through other disclosure methods
2. Using the ysoserial.net tool to generate a malicious serialized payload with the appropriate gadget chain
3. Encoding the payload as a valid ViewState string using the obtained keys
4. Submitting the crafted ViewState to a vulnerable endpoint
5. The server validates the ViewState signature, accepts it as legitimate, and deserializes the malicious payload, executing the attacker's commands

For technical details on the vulnerability mechanism and exploitation techniques, refer to the VulnCheck Advisory on Calero VeraSMART.

Detection Methods for CVE-2026-26335

Indicators of Compromise

• Unusual or malformed ViewState values in HTTP POST requests to VeraSMART web application endpoints
• Unexpected process spawning from the IIS worker process (w3wp.exe) associated with the VeraSMART application pool
• Suspicious command-line activity originating from the IIS application context, such as PowerShell or cmd.exe invocations
• Web server logs showing POST requests with abnormally large __VIEWSTATE parameter values

Detection Strategies

• Monitor IIS logs for POST requests containing suspicious ViewState payloads, particularly those with known ysoserial.net gadget chain signatures
• Implement application-level logging to capture and alert on ViewState validation failures or deserialization errors
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process creation from IIS worker processes
• Configure web application firewalls (WAF) to inspect and block requests containing known malicious serialized object patterns

Monitoring Recommendations

• Enable verbose logging on IIS servers hosting VeraSMART to capture full request details including ViewState parameters
• Establish baseline behavior for the VeraSMART application and alert on deviations such as unexpected network connections or file system modifications
• Implement process monitoring on servers to detect child processes spawned by w3wp.exe that are not part of normal application behavior

How to Mitigate CVE-2026-26335

Immediate Actions Required

• Upgrade Calero VeraSMART to version 2022 R1 or later, which addresses the static machineKey vulnerability
• If immediate upgrade is not possible, manually regenerate unique machineKey values in the web.config file for each VeraSMART installation
• Restrict network access to VeraSMART web applications to trusted networks or implement additional authentication layers
• Review IIS and application logs for signs of exploitation attempts

Patch Information

Calero has addressed this vulnerability in VeraSMART version 2022 R1. Organizations should upgrade to this version or later to receive proper machineKey randomization and eliminate the static key vulnerability. Contact Calero for upgrade assistance and patch availability.

Workarounds

• Generate and configure unique machineKey values (validationKey and decryptionKey) in the web.config file to replace the static keys
• Implement network segmentation to limit access to the VeraSMART web application from untrusted networks
• Deploy a web application firewall (WAF) configured to inspect and block suspicious ViewState payloads
• Consider disabling ViewState entirely if it is not required for application functionality, or implement ViewState encryption with custom, per-installation keys

To generate new unique machineKey values, administrators can use the IIS Manager or PowerShell scripts to create cryptographically random keys. Replace the existing machineKey element in C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config with newly generated values and restart the IIS application pool to apply the changes.