CISA warns of critical Armatura One vulnerabilities

What happened and what to do

In an advisory published on October 1, 2026, CISA reports that Armatura One and Armatura One (USA) are affected by critical vulnerabilities. CVE-2023-46604 concerns unsafe deserialization in the embedded Apache ActiveMQ: an unauthenticated network attacker could execute code with maximum privileges. CVE-2026-94591 concerns credentials protected by a fixed key and initialization vector embedded in the software, which can be recovered from the installation package. The advisory cites risks of unauthorized database access and takeover of the physical access control system; CVSS scores are 9.8 under version 3.1 and 9.3 under version 4.0. CISA recommends contacting Armatura technical support to obtain and apply the update.

A practical response starts by identifying installations and network exposure, restricting access to the OpenWire listener, and checking whether the product is present in critical infrastructure assets. A company can also plan the update with the vendor, review potentially exposed configurations and credentials, rotate secrets, and monitor suspicious connections and changes. An inventory and tracking dashboard can help prioritize systems and record remediation.

How the consultancy can help

Wendelmaques can diagnose exposure and affected assets, scope remediation, and implement network controls, credential rotation, and monitoring. The consultancy can also structure ongoing operations and remediation tracking.

Next step

Send a short description of your environment and Armatura One exposure to receive a scoped proposal for diagnosis and implementation.