Critical Vulnerabilities Discovered in Armatura LLC Armatura One Platform

Armatura LLC has issued a security advisory addressing multiple vulnerabilities in its Armatura One physical access-control and security management platform. The advisory, coordinated with CISA under ICSA-26-274-01, identifies five CVEs affecting deployments worldwide across critical infrastructure sectors including Communications, Critical Manufacturing, Energy, and Transportation Systems.

The most critical vulnerability, CVE-2023-46604, carries a CVSS v3 score of 9.8. It stems from the embedded Apache ActiveMQ component, which exposes its OpenWire protocol listener on the network by default. The deserialization flaw in the OpenWire marshaller allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked, potentially resulting in arbitrary code execution with the highest level of privilege on the host operating system.

CVE-2026-94591, rated CVSS 8.4 (v3) or 8.6 (v4), involves the use of hard-coded cryptographic keys and initialization vectors embedded in the software. These identical values across every installation allow an attacker in possession of the installation package to recover the key and IV, and subsequently decrypt stored database and message-broker credentials from the encrypted configuration file.

CVE-2026-94592 concerns the database initialization routine, which assigns a fixed, vendor-defined password to the database superuser account at creation time rather than generating a random password. This flaw facilitates unauthorized database access.

CVE-2026-94593 and CVE-2026-94594 were listed in the advisory but their detailed descriptions were not fully extracted in the source data. They are part of the same coordinated disclosure.

Affected product versions include Armatura One <4.7.2 and Armatura One (USA) <4.6.1. Armatura LLC has released Armatura One V4.7.2 for the global line and Armatura One V4.6.1_USA for the USA release line, which resolve the identified issues. Users are advised to upgrade from affected versions at the earliest opportunity. CISA recommends consulting the associated security advisory ICSA-26-274-01 for further guidance.