CVE-2026-85146: CWE-798 Use of Hard-coded Credentials in Lightstar SmartIT Desktop Manager

CVE-2026-85146 is a critical security vulnerability in Lightstar's SmartIT Desktop Manager caused by the use of hard-coded credentials (CWE-798). The flaw allows unauthenticated remote attackers to retrieve SSH service account credentials and passwords for the SmartIT Agent directly from the application's source code. This exposure can lead to unauthorized remote access and potential compromise of the affected system. The vulnerability has a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation. No vendor-provided patch or remediation details are currently available, and no known active exploits have been reported.

The vulnerability enables unauthenticated remote attackers to obtain sensitive SSH credentials embedded in the application's source code. This can lead to unauthorized remote access to the affected system, potentially allowing attackers to execute arbitrary commands or gain control over the SmartIT Agent. The high CVSS score reflects the critical nature of this exposure with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the SmartIT Desktop Manager and monitor for unauthorized access attempts. Avoid exposing the application to untrusted networks. Review and rotate any potentially compromised credentials if possible.