CVE-2026-26335 is a critical flaw (CVSS 9.8) in Calero VeraSMART versions before 2022 R1. The web application uses static ASP.NET machine key values, so anyone who obtains them can forge a ViewState payload and run code on the server. Upgrade to 2022 R1 or later, then replace the keys.
What's affected
The VulnCheck advisory and the NVD record list VeraSMART versions prior to 2022 R1 as affected. Confirm the exact fixed build with Calero.
The keys sit in C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config in the default install. The same product also has CVE-2026-26333, which allows a remote file read that can reach this file.
How to check if you're exposed
Check the VeraSMART version. Then inspect web.config in the web root for a machineKey element with fixed validation and decryption keys:
Select-String -Path "C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config" -Pattern machineKey
If the keys were shipped by the vendor and are the same on other installations, assume they are known to others.
What to do now
- Upgrade VeraSMART to 2022 R1 or later and confirm the fix with Calero.
- Generate new, unique machine keys for the application and restart IIS, so any previously obtained key stops working.
- Restrict who can read
web.configon the server, and close TCP port 8001 as described for CVE-2026-26333. - Search the server for unexpected files or processes if the system was reachable from untrusted networks.
Why it matters
The weakness is CWE-321, use of a hard coded cryptographic key. ASP.NET uses the machine key to sign and protect ViewState. If the key is the same everywhere or can be found, the signature proves nothing, and an attacker can build a payload that the application accepts and deserializes.
The vector shows network reach, no login and no user action, with high impact across the board. The record is not on the CISA Known Exploited Vulnerabilities list. Keys must be unique per installation and treated as secrets, even when they live in a config file.
Quick check
Does patching change the keys?
Do not assume it does. Check the web.config after the upgrade and generate new keys if you cannot confirm they are unique.
Sources
- VulnCheck advisory: Calero VeraSMART before 2022 R1 Static IIS Machine Keys Enable ViewState RCE
- NVD record for CVE-2026-26335
Last reviewed: 19 October 2026.
