CVE-2023-37286: Smartsoft Smartbpm.net

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

Affected products

• Smartsoft Smartbpm.net: version 6.70 only

Published 2023-07-10. Last modified 2026-06-17.