Armatura One: Use of hard-coded database superuser password
Summary
Armatura One assigns a fixed, vendor-defined password to the database superuser account at installation instead of a unique one per installation. A person with access to the server operating system who knows this value can log in as database superuser on deployments where the password has not been changed. The flaw is local; an attacker needs access to the host, but it can be combined with remote entry points such as the embedded ActiveMQ listener.
Affected
- Armatura One versions before 4.7.2
- Armatura One (USA) versions before 4.6.1_USA
Fixed in
- Armatura One V4.7.2
- Armatura One V4.6.1_USA (USA release line)
- Unknown whether the upgrade replaces the existing superuser password on already installed databases.
Workaround
- No vendor workaround documented; the fix is the upgrade.
- Restrict network access to the server and its database service to required management hosts only.
- Remove any internet exposure and place the system behind a firewall in a dedicated security zone.
- Change the database superuser password manually if it still has the vendor value; verify the procedure with Armatura first.
Exploitation
- CISA is not aware of exploitation specifically targeting this vulnerability.
- No public proof of concept is known.
- Related: CVE-2023-46604 in the same product and advisory is reported as exploited; check the CISA KEV catalogue directly.
Our recommendation
- Upgrade to Armatura One V4.7.2, or V4.6.1_USA for the USA release line; contact Armatura support for the upgrade procedure.
- Confirm with Armatura whether the upgrade changes the database superuser password on existing installations, and change it manually if not.
- Check whether the server is reachable from the internet or from flat networks, and isolate it.
- Review the server's OS accounts and monitor database logins for unexpected activity.
- Patch the other vulnerabilities in the same CISA advisory ICSA-26-274-01 at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-274-01 www.cisa.gov
- CISA CSAF JSON ICSA-26-274-01 github.com
- 1898 & Co. Advisory on Armatura One 1898advisories.burnsmcd.com
- OpenCVE CVE-2026-94592 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:23.
Original description (NVD)
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.