CISA ICSA-26-274-01: Armatura One Vulnerabilities (RCE via Deserialization, Hardcoded Credentials)

Vulnerability Overview Vulnerability Name: Armatura LLC Armatura One Release Date: October 1, 2026 Alert Code: ICSA-26-274-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: - Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) - Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) CVSS Score: v3 9.8 Vendor: Armatura LLC Device: Armatura LLC Armatura One Vulnerability Types: - Deserialization of Untrusted Data - Hardcoded Encryption Keys - Hardcoded Credentials - Sensitive Information Insertion in Logs Mitigation Strategies Recommended Practices: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote methods such as Virtual Private Networks (VPNs). Ensure the VPN is updated to the latest version and used only at the same security level as the connected devices. - Conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities and adhere to CISA's tracking and attribution procedures. - Do not click links in emails or open unsolicited attachments. - Refer to information provided by CISA on identifying and avoiding email scams. - Refer to information provided by CISA on avoiding social engineering and phishing attacks. Additional Information Background: - Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Transportation Systems - Deployed Countries/Regions: Global - Company Headquarters Location: United States Acknowledgments: - Andrew Capobianco of RewCon.co reported these vulnerabilities to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the Privacy and Usage Policy. Revision History: - Initial Release Date: 2026-10-01 - Revision: 1 - Summary: Initial Release Tags Sectors: Communications Sector, Critical Manufacturing Sector, Energy Sector, Transportation Systems Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories ABB Protection and Control IED Manager PCM600 CISA Malcolm Monta monta.app Johnson Controls EasyIO Neo Series EC and CW Controllers Feedback Share your thoughts: We recently updated our anonymous product survey; feedback is welcome. Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Official Statement CISA.gov is the official website of the U.S. Department of Homeland Security. Links About CISA Budget and Performance DHS.gov FOIA Requests Whistleblower Protection Act Office of Inspector General Privacy Policy Subscribe White House USA.gov Website Feedback Social Media Facebook Twitter LinkedIn YouTube Instagram RSS Back to Top Back to Top Navigation Bar Topics Highlights Resources and Tools News and Events Careers About Search Search Share Facebook Twitter LinkedIn Reddit Alert Code ICSA-26-274-01 Related Topics Industrial Control System Vulnerabilities Industrial Control Systems Vulnerability List CVE-2023-46604 CVE-2026-94591 CVE-2026-94592 CVE-2026-94593 CVE-2026-94594 Vulnerability Details CVE-2023-46604: Deserialization of Untrusted Data CVE-2026-94591: Hardcoded Encryption Keys CVE-2026-94592: Hardcoded Credentials CVE-2026-94593: Sensitive Information Insertion in Logs CVE-2026-94594: Deserialization of Untrusted Data Vulnerability Impact CVSS Score: v3 9.8 Vendor: Armatura LLC Device: Armatura LLC Armatura One Vulnerability Remediation Recommended Practices: - Minimize network exposure - Isolate control system networks - Use secure remote access methods - Conduct impact analysis and risk assessment - Implement cybersecurity strategies - Follow internal procedures - Avoid clicking unsolicited links or attachments - Refer to information provided by CISA Vulnerability Background Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Transportation Systems Deployed Countries/Regions: Global Company Headquarters Location: United States Vulnerability Acknowledgments Andrew Capobianco of RewCon.co Legal Notice This product is subject to this notice and the Privacy and Usage Policy. Revision History Initial Release Date: 2026-10-01 Revision: 1 Summary: Initial Release Tags Sectors: Communications Sector, Critical Manufacturing Sector, Energy Sector, Transportation Systems Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories ABB Protection and Control IED Manager PCM600 CISA Malcolm Monta monta.app Johnson Controls EasyIO Neo Series EC and CW Controllers Feedback Share your thoughts: We recently updated our anonymous pr

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-274-01: Armatura One Vulnerabilities (RCE via Deserialization, Hardcoded Credentials)

More from this source