The Cybersecurity and Infrastructure Security Agency warned that vulnerabilities in Armatura LLC’s Armatura One physical access-control system could let attackers reach its database, execute arbitrary code with the highest level of privilege on the host, or take control of the access-control system. The advisory identifies both Armatura One and Armatura One (USA) as affected products and rates the most serious vulnerability critical. CISA said it is not aware of exploitation specifically targeting Armatura One in connection with the flaws.
The highest-rated issue is CVE-2023-46604, a critical vulnerability with a CVSS v3.1 score of 9.8. Armatura One embeds Apache ActiveMQ and exposes its OpenWire protocol listener on the network by default, CISA said. The flaw allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked. Successful exploitation can produce arbitrary code execution with the highest level of privilege on the host operating system.
The advisory also describes three high-severity weaknesses involving credentials and cryptographic protection. CVE-2026-94591 uses a fixed AES-128-CBC encryption key and initialization vector embedded in the software for database and message-broker credentials. An attacker who obtains the installation package can recover those fixed values and decrypt credentials from an encrypted configuration file obtained from a particular installation.
CVE-2026-94592 assigns a fixed, vendor-defined password to the database superuser during initialization instead of generating a unique password for each deployment. A person with access to the server operating system and knowledge of that value could authenticate as the database superuser if the password has not been changed. CISA rates the issue 8.4 under CVSS v3.1.
Two additional flaws expose credentials through logs. CVE-2026-94593 causes the backup and restore routine to record the full database connection command, including the superuser password, in plain text on the host. CVE-2026-94594 causes the message broker to log client connection credentials and the associated password in plain text during normal operation. Access to those logs, or to a backup or support bundle containing them, could disclose credentials. CISA rates the first issue high and the second medium under CVSS v3.1.
CISA lists communications, critical manufacturing, energy and transportation systems among the critical-infrastructure sectors where the product is deployed, and says deployments are worldwide. The agency attributes the vulnerability reports to Andrew Capobianco of RewCon.co. The advisory groups the findings under deserialization of untrusted data, hard-coded cryptographic keys, hard-coded credentials and sensitive information in log files.
Armatura identifies a vendor fix for all versions of Armatura One and Armatura One (USA), but the advisory does not provide a version number for the fix. Armatura recommends that customers contact official technical support for guidance on obtaining and applying the upgrade. CISA advises minimizing network exposure for control-system devices, keeping them off the public internet, placing control-system networks behind firewalls and isolating them from business networks. Where remote access is necessary, the agency recommends more secure methods such as updated virtual private networks, while cautioning that VPN security depends on the connected devices.
CISA also advises organizations to perform an impact analysis and risk assessment before deploying defensive measures and to follow established internal procedures if they observe suspected malicious activity. The agency directs organizations to report such findings to CISA for tracking and correlation with other incidents.