CVE-2026-26333

The .NET Remoting service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) with the TypeFilterLevel parameter set to Full, allowing data deserialization using SOAP and binary formatters without any authentication. An attacker can invoke exposed endpoints and use the WebClient class to read server files, including WebRoot\web.config containing IIS machineKey validation and decryption keys. With knowledge of these keys, the attacker can generate a malicious ASP.NET ViewState payload and achieve RCE in the context of the IIS application. Additionally, providing a UNC path forces the service account to perform outbound SMB authentication, exposing the NTLMv2 hash to interception and relay attacks or offline cracking.

An unauthenticated remote attacker can achieve complete arbitrary code execution (RCE) in the context of the IIS application, read and write arbitrary files on the server, and intercept NTLMv2 hashes of the service account for further lateral movement in the network.

Update Calero VeraSMART to version 2022 R1 or later. Until the patch is deployed, it is recommended to block access to TCP port 8001 on the firewall for unauthorized sources and restrict outbound SMB traffic from the service server to reduce the risk of NTLMv2 hash interception.

Calero VeraSMART in versions prior to 2022 R1