Armatura One: Insertion of sensitive information into log file
Summary
Armatura One writes the full database connection command, including the superuser password, in plain text to a log file on the host during backup and restore. An attacker with access to the server operating system can read the credentials and use them to access the database. The CVE record and CISA describe this as a post-compromise issue; no network path is opened by this flaw itself.
Affected
- Armatura One before 4.7.2
- Armatura One (USA) before 4.6.1_USA
Fixed in
- Armatura One V4.7.2 (users on V4.7.1 or earlier should upgrade)
- Armatura One (USA) V4.6.1_USA (users on V4.3.1_USA or earlier should upgrade)
Workaround
- Rotate the database superuser password and the message-broker credentials, and treat credentials stored in the installation configuration as exposed
- Delete existing backup, restore and broker log files, or restrict access to them
- Review backups and support bundles shared with third parties for plain-text credentials
- Unknown whether CISA lists further mitigations; the full list is in the CSAF file
Exploitation
- No public proof of concept found
- Not listed in CISA KEV according to one snapshot; the KEV status of this CVE could not be confirmed
- Unknown whether this CVE has been exploited in the wild
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Upgrade Armatura One to V4.7.2, or to V4.6.1_USA for the USA release line; request the upgrade files from Armatura technical support
- Until patched, rotate the database and broker credentials and purge or restrict access to log and backup files
- Restrict access to the server operating system to administrators only
- Keep Armatura One servers off untrusted networks and check for other CVEs in the same CISA advisory ICSA-26-274-01
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICSA-26-274-01 www.cisa.gov
- CISA CSAF JSON ICSA-26-274-01 github.com
- OpenCVE CVE-2026-94593 app.opencve.io
- Burns McDonnell advisory brief 1898advisories.burnsmcd.com
- VulDB CVE-2026-94593 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:32.
Original description (NVD)
Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.