CVE-2026-26334 is a vulnerability in Calero VeraSMART prior to version 2026 R1 where hardcoded static AES encryption keys are embedded in the Veramark.Framework.dll (specifically in the Veramark.Core.Config class). These keys encrypt the password of a service account stored in a local file (C:\VeraSMART Data\app.settings). An attacker with local system access can extract these hardcoded keys from the DLL, decrypt the stored password, and use the recovered credentials to authenticate to the Windows host. This can lead to local privilege escalation depending on the privileges assigned to the service account.

The vulnerability allows an attacker with local access to decrypt stored service account credentials by extracting hardcoded AES keys from a DLL. This can enable the attacker to authenticate as the service account on the Windows host, potentially escalating privileges locally if the service account has elevated rights.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to affected systems and the VeraSMART installation directory to trusted users only to reduce the risk of key extraction and credential compromise.