CVE-2026-26333 is a critical vulnerability in Calero VeraSMART versions prior to 2022 R1 where an unauthenticated .NET Remoting HTTP service is exposed on TCP port 8001. The service publishes default ObjectURIs and permits SOAP and binary formatters with TypeFilterLevel set to Full, enabling unauthenticated remote attackers to invoke remoting endpoints to read and write arbitrary files via the WebClient class. Sensitive files such as WebRoot\web.config can be retrieved, disclosing IIS machineKey validation and decryption keys. These keys can be used to generate malicious ASP.NET ViewState payloads to achieve remote code execution within the IIS application context. Additionally, attackers can supply UNC paths to trigger outbound SMB authentication from the service account, potentially exposing NTLMv2 hashes for relay or offline cracking. There is no vendor advisory or patch information available at this time.

An unauthenticated remote attacker can read and write arbitrary files on the affected system, leading to disclosure of sensitive configuration files and cryptographic keys. This enables remote code execution within the IIS application context. Furthermore, the vulnerability can be leveraged to capture NTLMv2 hashes via outbound SMB authentication, increasing the risk of credential theft and lateral movement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict network access to TCP port 8001 to trusted administrators only and monitor for any unusual activity related to .NET Remoting services. Consider disabling the exposed .NET Remoting HTTP service if it is not required.