CVE-2026-26333 is a critical flaw (CVSS 9.8) in Calero VeraSMART versions before 2022 R1. An unauthenticated .NET Remoting service on TCP port 8001 lets a remote attacker read and write files, which can lead to code execution. Upgrade to 2022 R1 or later and block that port.
What's affected
The VulnCheck advisory and the NVD record list Calero VeraSMART versions prior to 2022 R1 as affected. Release 2022 R1 is the first one the advisory title treats as outside the range, so upgrade to 2022 R1 or later and confirm the exact fixed build with Calero.
The service in question is an HTTP .NET Remoting endpoint on TCP port 8001 that publishes default object URIs, including EndeavorServer.rem and RemoteFileReceiver.rem. It accepts SOAP and binary formatters with the type filter level set to Full.
A second record, CVE-2026-26335, covers static IIS machine keys in the same product and is closely linked to this one.
How to check if you're exposed
Check the installed VeraSMART version first. Then see whether the remoting service is listening on the host:
Get-NetTCPConnection -LocalPort 8001 -State Listen -ErrorAction SilentlyContinue
From another machine on the network, test whether the port is reachable:
Test-NetConnection -ComputerName your-server -Port 8001
If the port answers from a network segment that is not strictly administrative, treat the server as exposed. Check firewall rules at the host and the network edge as well.
What to do now
- Upgrade VeraSMART to 2022 R1 or later, and ask Calero to confirm the fixed build for your installation.
- Block TCP port 8001 from everything except the systems that need it, and never expose it to the internet.
- Rotate the ASP.NET machine keys in the application's
web.configafter upgrading. The advisory says the keys could be read through this flaw, so assume that earlier exposure means earlier disclosure. - Block outbound SMB (TCP 445) from the server, since the advisory describes forced outbound SMB authentication through UNC paths that can expose NTLMv2 hashes.
- Review the server for unexpected files and for recent access to
web.config.
Why it matters
Two weaknesses combine here. CWE-306 is missing authentication for a critical function: the remoting endpoints accept calls from anyone. CWE-502 is deserialization of untrusted data: the formatters rebuild objects from caller supplied input with the type filter set to Full, the most permissive setting.
The advisory describes a chain. An attacker reads WebRoot\web.config, which can hold the IIS machine key validation and decryption keys. With those, a forged ASP.NET ViewState payload passes integrity checks and the application deserializes it, giving code execution in the IIS application context. The UNC path trick can also expose the service account's NTLMv2 hash for relay or offline cracking.
The record is not on the CISA Known Exploited Vulnerabilities list.
The lesson reaches past one product. A file read is rarely just a file read when secrets sit in a config file next to the code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading enough?
Upgrade first, then rotate the machine keys and review the server. The advisory says those keys can be read through the flaw, so earlier exposure may mean they are known.
How is this related to CVE-2026-26335?
That record covers static machine keys stored in web.config. Together they make a path from a network call to code execution.
Sources
- VulnCheck advisory: Calero VeraSMART before 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE
- NVD record for CVE-2026-26333
Last reviewed: 19 October 2026.
