Armatura LLC Armatura One

1. Executive summary

CISA published ICSA-26-274-01 on 2026-10-01 covering five vulnerabilities in Armatura LLC Armatura One, a physical access-control platform deployed worldwide across the communications, critical manufacturing, energy and transportation sectors. The most serious is CVE-2023-46604, a deserialization flaw in the Apache ActiveMQ OpenWire marshaller embedded in Armatura One, rated CVSS 10.0 CRITICAL, listed in CISA KEV since 2023-11-02, with an EPSS score of 100%. Armatura One exposes the OpenWire listener on the network by default, and the flaw is reachable before authentication, so an unauthenticated network attacker can execute code at the highest privilege level on the host, or take control of the physical access-control system itself. CISA states it is not aware of exploitation specifically targeting Armatura One, but notes CVE-2023-46604 has been used in ransomware campaigns against other Apache ActiveMQ deployments. For EMEA financial services clients running Armatura One on physical security or building-management networks, the exposure is a pre-auth remote code execution path into a system that controls door access, and the four remaining findings compound it by placing database and broker credentials within reach of anyone who already has host or log access.

2. Regulatory framing

No DORA incident-reporting article is engaged by this item on the facts available: CISA states it is not aware of exploitation targeting Armatura One, so there is no incident to classify or report. If a client finds exploitation in its own estate, DORA Art. 17, Art. 18 and Art. 19 and NIS2 Art. 23 become live at that point.

3. Technical analysis & attack chain

CISA assigns five vulnerabilities to Armatura One below version 4.7.2 (and below 4.6.1 on the USA release line). One is a pre-authentication remote code execution flaw in an embedded component; the other four are credential and information-disclosure weaknesses that require some existing level of host, log or package access. CISA does not describe a single observed intrusion chain, so the sequence below is the exploitation path the vulnerabilities themselves permit, not a recorded incident.

1. Reconnaissance and reachability. Armatura One embeds Apache ActiveMQ and exposes its OpenWire protocol listener on the network by default. An attacker who can reach that listener over the network has the precondition for step 2. No credentials are needed at this stage.
2. Pre-auth deserialization (CVE-2023-46604). The embedded ActiveMQ version is affected by a deserialization flaw in the OpenWire marshaller. An unauthenticated network attacker can trigger deserialization of an arbitrary object graph before authentication is checked. CISA rates this CVSS 3.1 9.8 CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 CRITICAL. The verified reference data records CVSS 10.0 CRITICAL, CWE-502, KEV-listed since 2023-11-02, EPSS 100%; the 10.0 is the NVD base score for the underlying ActiveMQ CVE, while CISA's advisory quotes the 9.8 vector above. Both describe the same flaw.
3. Arbitrary code execution at highest privilege. Successful deserialization results in arbitrary code execution with the highest level of privilege on the host operating system. From that point the attacker holds the Armatura One server, and with it the physical access-control system the product manages: door state, access rights and the audit record of both.
4. Credential recovery from the install configuration (CVE-2026-94591, CWE-321). Armatura One stores database and message-broker credentials in an install configuration file, encrypted with AES-128-CBC when that protection is enabled. The encryption key and initialization vector are fixed values embedded in the software and identical across every installation. An attacker with a copy of the installation package can recover the key and IV, then decrypt the stored credentials of any installation whose encrypted configuration file they separately obtain. CISA rates this CVSS 3.1 8.4 HIGH (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
5. Database superuser via fixed password (CVE-2026-94592, CWE-798). The database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time rather than generating a unique password per installation. Anyone with server operating system access and knowledge of that value can authenticate as database superuser on any deployment where it has not been changed. CVSS 3.1 8.4 HIGH.
6. Plaintext credentials in logs (CVE-2026-94593 and CVE-2026-94594, both CWE-532). The backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host (CVSS 3.1 7.8 HIGH). Separately, the message broker logs client connection credentials and the associated password in plain text during normal operation, so any party with read access to that log, or to a backup or support bundle containing it, obtains the logged credential (CVSS 3.1 4.0 MEDIUM). These two findings mean that even without the deserialization flaw, credentials sufficient to reach the database are written to disk in clear text during routine operation.

Impact. The combination matters more than any single entry. CVE-2023-46604 gives an unauthenticated network attacker code execution on the host; the four credential findings mean that an attacker who obtains the install package, the host filesystem, a log file or a support bundle can recover database and broker credentials without exploiting the deserialization flaw at all. CISA's stated impact is unauthorised database access, arbitrary code execution at highest privilege, or control of the physical access-control system.

Exploitation status. CISA states it is not aware of exploitation specifically targeting Armatura One in relation to these vulnerabilities. CVE-2023-46604 itself is in CISA KEV and, per CISA, has been used in ransomware campaigns against other Apache ActiveMQ deployments. That is a statement about the ActiveMQ CVE generally, not about Armatura One; no ransomware activity against Armatura One is reported.

Confidence. All technical detail above is from the CISA advisory ICSA-26-274-01 and its CSAF JSON, which is a single authoritative source. There is no independent vendor or third-party corroboration in the material provided, and no observed-incident reporting. The four CVE-2026-9459x identifiers appear only in this advisory; treat them as single-sourced until Armatura or a second party publishes.

4. Mitigation & containment

P1 (within 24 hours)

• Identify every Armatura One instance and record its version. Affected: all versions below 4.7.2, and USA release line below 4.6.1. Anything at 4.7.1 or earlier (or 4.3.1_USA or earlier) is in scope.
• Restrict network reachability to the embedded ActiveMQ OpenWire listener. It is exposed by default; if the listener does not need to be reachable from outside the Armatura One host or its management segment, block it at the host firewall and at the segment boundary. This removes the pre-auth RCE path in step 2 without waiting for the upgrade.
• Treat any Armatura One host that has been reachable on the OpenWire port from an untrusted network as potentially compromised. CVE-2023-46604 is KEV-listed and executes before authentication, so there is no log entry that proves the host was not touched. Hunt for post-exploitation activity on those hosts before assuming they are clean.
• Change the database superuser password on every deployment where the vendor default has not been changed (CVE-2026-94592). Do this on the database itself, not only in the application configuration.

P2 (within 72 hours)

• Upgrade to Armatura One V4.7.2 (standard line) or V4.6.1_USA (USA line). Armatura states these releases resolve all five issues. The vendor directs customers to contact official technical support for guidance on obtaining and applying the upgrade, so open that request now; the support dependency is the likely bottleneck, not the maintenance window.
• Rotate the database and message-broker credentials stored in the install configuration file (CVE-2026-94591). The AES-128-CBC key and IV are fixed and identical across installations, so any encrypted configuration file that has left the host, including in a support bundle, should be treated as readable by anyone holding the install package.
• Locate and purge the plaintext credential logs. The backup and restore routine writes the full database connection command including the superuser password to a log file on the host (CVE-2026-94593), and the message broker logs client connection credentials and passwords during normal operation (CVE-2026-94594). Rotate any credential that appears in those logs, and review retention and access on any backup or support bundle that includes them.
• Restrict read access to Armatura One log directories and to support bundles to the minimum set of accounts, since the logs are themselves a credential source.

P3 (within 7 days)

• Add detection for the OpenWire listener being contacted from unexpected sources, and for process creation on Armatura One hosts that is not part of normal operation. Where the host runs an EDR agent, confirm it is actually collecting from the Armatura One server rather than only from the corporate estate.
• Review whether Armatura One belongs on a network segment with any route to payment, core banking or customer data systems. It is a physical access-control system; it should not share a trust boundary with them.
• Confirm the Armatura support and patch-delivery obligation is written into the contract where Armatura One is a material ICT service (see §2, DORA Art. 30).

5. Indicators of compromise

No indicators of compromise available in the source material. CISA's advisory names no hashes, domains, IP addresses, file paths or command lines, and states it is not aware of exploitation targeting Armatura One.

The sources do describe observable conditions that a defender can hunt against. These are behaviours and configuration states, not atomic indicators, so they are listed separately and are not placed in the copyable block.

Behavioural indicators

6. Detection

The sources give no file hashes, mutexes, registry keys or command-line strings for the threat itself. The only concrete artefacts are the product, the embedded component and the protocol listener, and a rule built from those would detect reporting about the advisory rather than the threat. There is one usable behavioural signal: the OpenWire listener being contacted from outside the expected management segment. That is expressed as a Sigma rule below, keyed on the default ActiveMQ OpenWire port. Confirm the actual listening port on your deployment before enabling, since the advisory does not state it and the default may have been changed.

title: Armatura One Embedded ActiveMQ OpenWire Listener Contacted From Non-Management Source
id: 7f3c1a92-4b6e-4d21-9c88-0a5e2d7b1f44
status: experimental
description: >
  Detects inbound network connections to the Apache ActiveMQ OpenWire listener embedded in
  Armatura One from sources outside the expected management segment. Armatura One exposes the
  OpenWire listener by default and the embedded version is affected by CVE-2023-46604, a
  pre-authentication deserialization flaw in the OpenWire marshaller. Reference: CISA ICSA-26-274-01.
author: Adverse Trace
date: 2026-10-01
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01
logsource:
  category: firewall
  product: any
detection:
  selection_port:
    dst_port: 61616
  filter_management:
    src_ip|cidr:

      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_port and not filter_management
falsepositives:

  - Legitimate administrative access from a management network not covered by the RFC1918 ranges above
  - Deployments where the OpenWire port has been changed from the default
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• CISA, "Armatura LLC Armatura One", ICSA-26-274-01, published 2026-10-01. https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01
• CISA, ICSA-26-274-01 CSAF JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json

8. Adverse Trace position

Adverse Trace assesses CVE-2023-46604 in Armatura One as the priority item here: CVSS 10.0 CRITICAL in the verified reference data, KEV-listed since 2023-11-02, EPSS 100%, reachable before authentication on a listener that is on by default. The four CVE-2026-9459x findings are individually lower rated but they remove the need to exploit the deserialization flaw at all, because they place database and broker credentials in the install package, the host filesystem and the logs. For EMEA financial services clients, the client-impact question is not whether Armatura One holds customer data, it is whether the physical access-control system shares a trust boundary with anything that does; where it does, a compromise of the access-control host is a route into the estate rather than a standalone building-security problem. All technical detail in this advisory rests on a single source, CISA ICSA-26-274-01, and the four CVE-2026-9459x identifiers appear nowhere else in the material we hold, so we treat them as single-sourced and will revise if Armatura or a second party publishes. CISA reports no exploitation targeting Armatura One; we have no evidence of exploitation in client estates either, and we are not raising this above the vendor's own severity on that basis. We will track Armatura's support response times for the V4.7.2 and V4.6.1_USA upgrades, and we will reissue this advisory if exploitation against Armatura One is reported or if the CVE-2026-9459x identifiers are corroborated.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.