https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26335.htmlhttps://patchthecve.com/cve/CVE-2026-26335.htmlWed, 17 Jun 2026 10:26:06 +0000CRITICAL 9.8: Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passeshttps://patchthecve.com/cve/CVE-2026-26334.htmlhttps://patchthecve.com/cve/CVE-2026-26334.htmlWed, 17 Jun 2026 10:26:06 +0000HIGH 7.8: Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with local access to the systhttps://patchthecve.com/cve/CVE-2026-26333.htmlhttps://patchthecve.com/cve/CVE-2026-26333.htmlWed, 17 Jun 2026 10:26:06 +0000CRITICAL 9.8: Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An