CVE-2026-26335: Calero Verasmart

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.

Affected products

• Calero Verasmart: before 2022.0 (fixed in 2022.0); version 2022.0 only

Published 2026-02-13. Last modified 2026-06-17.