VeraSMART vulnerabilities

3 known vulnerabilities in VeraSMART from Calero. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  VeraSMART: Use of Hard-coded Cryptographic Key

  CVE-2026-26335Feb 13, 2026CaleroEPSS 2.95%

  Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a val

• 7.8 High severity

  VeraSMART: Use of Hard-coded Credentials

  CVE-2026-26334Feb 13, 2026Calero

  Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. A

• 9.8 Critical severity

  VeraSMART: Missing Authentication for Critical Functionality

  CVE-2026-26333Feb 13, 2026CaleroEPSS 1.05%

  Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatte