Armatura LLC Armatura One

CISA has released ICS advisory ICSA-26-274-01 for Armatura LLC Armatura One, a physical access-control system. Five vulnerabilities are disclosed affecting versions prior to 4.7.2 (and 4.6.1 for the USA release). The most critical is CVE-2023-46604 (CVSS 9.8), a deserialization flaw in embedded Apache ActiveMQ allowing unauthenticated remote code execution with highest privileges. CVE-2026-94591 involves a hard-coded AES encryption key used to protect configuration credentials. CVE-2026-94592 is a hard-coded database superuser password present across all installations. CVE-2026-94593 and CVE-2026-94594 both involve plaintext credential exposure in log files. Affected sectors include Communications, Critical Manufacturing, Energy, and Transportation. Vendor fixes are available; users should upgrade to V4.7.2 or V4.6.1_USA. CVE-2023-46604 is listed in CISA's KEV catalog and has been used in ransomware campaigns against Apache ActiveMQ deployments.