CISA has warned that vulnerabilities in Armatura LLC’s Armatura One physical access-control platform could let attackers obtain unauthorized database access, execute code with the highest privileges on the host, or take control of the access-control system. The advisory identifies both Armatura One and Armatura One (USA) as affected products and assigns the overall vulnerability listing a CVSS v3 score of 9.8.

The most severe issue is CVE-2023-46604, a critical Apache ActiveMQ flaw embedded in Armatura One. The product exposes ActiveMQ’s OpenWire listener on the network by default. CISA said an unauthenticated network attacker can trigger deserialization of an arbitrary object graph before authentication is checked, potentially resulting in arbitrary code execution with the highest level of privilege on the host operating system. The vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3.

The flaw requires no privileges or user interaction under the listed CVSS metrics, and CISA characterized the affected product status as “known_affected.” The advisory also lists CVE-2023-46604 among the issues covered by its warning, while stating that CISA is not aware of exploitation specifically targeting Armatura One in connection with these vulnerabilities.

Four additional vulnerabilities affect credentials and sensitive information stored or handled by the platform. CVE-2026-94591 concerns a fixed encryption key and initialization vector embedded in the software. When Armatura One encrypts database and message-broker credentials in an installation configuration file, the same fixed values are used across installations. An attacker who obtains the installation package and the encrypted configuration file could recover those credentials, CISA said. The issue is rated high, with CVSS v3.1 and v4.0 scores of 8.4 and 8.6.

CVE-2026-94592 involves a fixed, vendor-defined password assigned to the database superuser during initialization. A person with access to the server operating system and knowledge of that password could authenticate as the database superuser if the password had not been changed. CISA gave this vulnerability the same 8.4 CVSS v3.1 and 8.6 CVSS v4.0 scores.

The remaining findings involve plaintext credentials in logs. Armatura One’s backup and restore routine records the full database connection command, including the superuser password, in a host log under CVE-2026-94593. The message broker also records client connection credentials and the associated password in plaintext during normal operation under CVE-2026-94594. Access to those logs, or to a backup or support bundle containing them, could expose the credentials. CISA rated the first issue high and the second medium.

CISA said Armatura LLC provides a vendor fix for all listed Armatura One and Armatura One (USA) versions and recommends that users contact official technical support for guidance on obtaining and applying the upgrade. The advisory does not identify a specific fixed version. It recommends minimizing network exposure for control-system devices, keeping them off the public internet, placing control-system networks behind firewalls, isolating them from business networks, and using secure methods such as updated virtual private networks when remote access is required.

The products are deployed worldwide, according to the advisory, across communications, critical manufacturing, energy and transportation systems. CISA credited Andrew Capobianco of RewCon.co with reporting the vulnerabilities and urged organizations that observe suspected malicious activity to follow internal procedures and report findings to the agency.