All vulnerabilities
CVE-2026-94592

Armatura LLC Armatura One Use of Hard-coded Credentials

Armatura LLC Armatura One
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.7.2Also 4.6.1CVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

Text from CVE List

Affected versions 4

  • Armatura Oneaffected: all versions before 4.7.2CVE List
  • Armatura Oneunaffected: 4.7.2CVE List
  • Armatura One (USA)affected: all versions before 4.6.1CVE List
  • Armatura One (USA)unaffected: 4.6.1_USACVE List

References 2