Date: October 5, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Industrial Cybersecurity / Critical Infrastructure / Physical Access Control / Vulnerability Alert
Tags: Armatura, Armatura One, Access Control, Biometrics, CISA, ICSA-26-274-01, ICS, SCADA, RCE
Executive Summary
In early October 2026, physical security and industrial operational technology (OT) infrastructure faced an urgent warning as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published industrial advisory ICSA-26-274-01, with technical reporting by Aviatrix Threat Research and Security Boulevard. The advisory details five critical vulnerabilities affecting Armatura One, a flagship web-based physical access control and biometric identity management platform developed by Armatura LLC.
Armatura One is deployed across government facilities, data centers, manufacturing plants, corporate campuses, and healthcare networks to manage physical door controllers, biometric facial recognition terminals, smart turnstiles, and RFID card readers. The newly disclosed vulnerabilities—which include unauthenticated remote code execution, SQL injection, hardcoded cryptographic credentials, and deserialization flaws—allow remote attackers to bypass physical access barriers, unlock facility doors, disable intruder alarms, and harvest sensitive biometric employee databases.
Deep-Dive Technical Analysis of the Armatura One Vulnerabilities
Advisory ICSA-26-274-01 outlines five vulnerabilities affecting all Armatura One versions prior to v4.7.2:
1. ActiveMQ Remote Code Execution (CVE-2023-46604)
Armatura One integrates an embedded instance of Apache ActiveMQ to coordinate real-time event messaging between central management servers and distributed physical door controllers:
* The Deserialization Primitive: The platform incorporates a vulnerable version of Apache ActiveMQ subject to CVE-2023-46604.
* Remote Code Execution: Unauthenticated network attackers can send crafted OpenWire protocol commands over TCP port 61616 to instantiate arbitrary Java classes on the server host, executing operating system commands with full system administrative privileges.
2. Hardcoded Cryptographic Keys & Authentication Bypass (CVE-2026-94591)
The web-based administration console and edge controller synchronization modules rely on hardcoded cryptographic material:
* Embedded Private Keys: Security auditors identified pre-shared cryptographic secrets embedded directly in compiled application binaries.
* Administrative Session Forgery: Attackers can use these static keys to decrypt communication sessions, forge administrative session tokens, and bypass web authentication portals without needing valid user credentials.
3. Blind SQL Injection in Credential Management (CVE-2026-94592)
Administrative endpoints servicing employee badge issuance and access privilege assignment suffer from severe SQL injection vulnerabilities:
* Input Validation Breakdown: Inbound parameters passed to the employee access scheduling and visitor tracking modules fail to properly parameterize database queries.
* Database Extraction: Attackers can extract the entire backend database, dumping facial recognition vector templates, badge RFID hexadecimal codes, employee personal identifiers, and access-control event logs.
4. Direct Physical Device Override via Controller Manipulation
Once an adversary compromises the central Armatura One server via RCE or authentication bypass:
* Facility Door Unlocking: The attacker can send direct control commands to connected edge door controllers (such as the AHSC-1000 and AHDU series), forcing physical locks to open, disabling access schedules, or triggering continuous "lockdown" states to trap building occupants.
* Surveillance and Alarm Suppression: Attackers can disable integration hooks to CCTV cameras, intrusion detection systems, and fire alarms, masking physical unauthorized entry.
Advisory Parameter
Technical Detail
CISA Advisory Code
ICSA-26-274-01
Vulnerable Platform
Armatura LLC Armatura One (All versions < 4.7.2)
Associated CVEs
CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594
Vulnerability Classes
Insecure Deserialization, Hardcoded Credentials, SQL Injection, Privilege Escalation
Highest CVSS Score
9.8 (Critical)
Physical World Impact
Remote opening of physical locks, disabling of security alarms, biometric theft
Fixed Software Release
Armatura One v4.7.2
The Convergence Crisis of Cyber and Physical Security
The Armatura One vulnerabilities illustrate the severe risks of cyber-physical convergence:
* Digital Exploits with Physical Consequences: In traditional IT environments, a breach results in data loss; in access control environments, a breach allows adversaries to physically walk into server rooms, executive offices, and defense manufacturing floors.
* Biometric Permanence: Unlike passwords or badge numbers, compromised facial recognition templates cannot be reset, creating lifelong identity risks for facility personnel.
Recommendations and Mitigations
Facility managers, physical security directors, and enterprise IT security teams must immediately execute the following mitigations:
1. Upgrade Armatura One to Version 4.7.2 Immediately: Obtain the patched software distribution directly from Armatura technical support and apply it across all master and backup access control servers.
2. Isolate Physical Access Control Networks:
* Segregate the access control platform, door controllers, and biometric readers into a dedicated, air-gapped or strictly firewalled OT VLAN.
* Block all inbound access to ActiveMQ (port 61616) and web management interfaces (ports 80/443/8443) from the public internet and general corporate user networks.
3. Audit Door Event Logs and Hardware Controller State:
* Review historical Armatura One transaction logs for abnormal unlock commands, unexplained configuration updates, or newly created administrator accounts.
* Verify controller firmware versions and ensure physical tamper sensors on door controller enclosures remain armed.
4. Enforce Secondary Authentication on Critical Facility Zones: Require dual-custody verification (e.g., security guard verification or secondary physical key locks) for access to critical infrastructure locations (such as data centers and telecommunications rooms).