Skip to content
OpenAdvisories
Critical 1 exploited CVE ICSA-26-274-01 5 CVEs

Armatura LLC Armatura One

Published Oct 1, 2026 · Updated Oct 1, 2026

Vendor: Armatura Product: One Product: One (USA)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system.

Vulnerabilities 5

  • Critical 10.0
    CVE-2023-46604 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Legacy OpenWire Module activemq Debian Ubuntu Maven
    KEV Nov 2, 2023
  • High 8.4
    CVE-2026-94591

    Armatura LLC Armatura One Use of Hard-coded Cryptographic Key

    Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and a…

    Armatura Armatura One (USA) Armatura One
  • High 8.4
    CVE-2026-94592

    Armatura LLC Armatura One Use of Hard-coded Credentials

    Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and…

    Armatura Armatura One Armatura One (USA)
  • High 7.8
    CVE-2026-94593

    Armatura LLC Armatura One Insertion of Sensitive Information into Log File

    Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the serv…

    Armatura Armatura One Armatura One (USA)
  • Medium 4.0
    CVE-2026-94594

    Armatura LLC Armatura One Insertion of Sensitive Information into Log File

    Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

    Armatura Armatura One (USA) Armatura One

Revision history

  1. #1

    Initial Publication

References