Armatura One Updates Fix Critical Code Execution and Credential Flaws
Tech GuruQuick Answer
Update Armatura One to 4.7.2 or the USA branch to 4.6.1_USA through official support. The five findings include an embedded ActiveMQ unauthenticated code-execution flaw and credentials exposed through fixed secrets, configuration or logs. The ActiveMQ CVE is already known exploited; the advisory does not establish exploitation of a specific Armatura installation.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Armatura One and Armatura One USA, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Armatura One and Armatura One USA |
|---|---|
| Advisory | ICSA-26-274-01 |
| CVEs | CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594 |
| Authoritative release date | 2026-10-01 (CISA public advisory date; CSAF current release 2026-10-01 06:00 UTC) |
| Authority revision date | Initial public publication; no later material revision stated when verified |
| Affected versions | Armatura One before 4.7.2 and Armatura One USA before 4.6.1_USA. |
| Fixed version | Armatura One 4.7.2 / Armatura One USA 4.6.1_USA |
| CVSS base score | 4.0 / 7.8 / 8.4 / 9.8 (official CVSS v3.1) |
| CVSS severity | Medium to Critical |
| Exploitation status | CVE-2023-46604 is in CISA KEV (added November 2, 2023; ransomware use Known). CISA reports no known public exploitation specifically targeting this Armatura advisory. Component-level exploitation is not proof that a particular Armatura deployment is compromised. |
What Changed
The embedded OpenWire listener creates a network attack path for CVE-2023-46604. The other findings have different prerequisites, including access to encrypted configuration, server operating-system access or readable logs/support bundles. Updating software does not retroactively remove credentials already copied from those locations.
What To Validate Now
- Inventory. Locate Armatura One and Armatura One USA deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the exact product and affected-version statement in ICSA-26-274-01. Do not generalize the finding to another product, service, or release.
- Remediate. Obtain the correct Armatura One or USA update from official support and restrict unnecessary management/broker access while scheduling it. Ask the vendor for the supported process to rotate exposed database and broker credentials; do not manually replace embedded components or reset secrets without accounting for dependencies.
- Validate. Confirm the correct branch/build, application and controller connectivity, and an authorized credential/access event with facilities staff. Preserve logs under restricted access, inspect unexpected broker sessions and administrative changes, and document credential rotation where warranted. Do not test by interrupting occupied-site access or emergency egress.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Test changes in a representative environment, preserve configurations and forensic evidence before destructive action, coordinate with operations and safety owners, and treat exposure reduction as a mitigation rather than proof of remediation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
