Taiwan’s TWCERT/CC published an advisory on September 4, 2026 covering four vulnerabilities in SmartIT Desktop Manager, an endpoint management suite from Lightstar. All four are the same failure: credentials sitting in the application’s source code where an unauthenticated remote attacker can read them. Two are scored 9.8. The remediation the advisory gives is not a patch level — it is “Update SmartIT Desktop Manager to version 11 or later,” from an affected range of version 10 and earlier.
What happened
The advisory is titled “Lightstar | SmartIT Desktop Manager – 4 Vulnerabilities.” The four CVE records reached NVD on September 4, 2026 at 3:17 a.m. UTC, assigned by [email protected]. Read in the order an attacker would use them, they chain.
CVE-2026-85147, 7.5 under CVSS v3.1 and 8.7 under CVSS v4.0. NVD’s description: “Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.” That is the wrapper coming off — the encryption protecting agent-to-server traffic is keyed by something recoverable from the shipped application.
CVE-2026-85146, 9.8 under v3.1 and 9.3 under v4.0, CWE-798. “Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.” The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-85148, also 9.8 and 9.3, CWE-798. “Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.” That is the payoff sentence in the batch, and it is the one worth reading twice: a fixed password, remote access, user hosts, no authentication required to obtain it.
CVE-2026-85149, 5.3 under v3.1 and 6.9 under v4.0, CWE-798. “Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user’s host.”
The credits are unusually specific for a national CERT advisory. TWCERT names Huding and Linwz of DEVCORE for CVE-2026-85146, Huding of DEVCORE for CVE-2026-85148, and Jay of DEVCORE for CVE-2026-85147 and CVE-2026-85149. DEVCORE is the Taiwanese offensive security firm best known outside Taiwan for the 2021 Exchange ProxyLogon research. Four findings in one product, from three researchers at one firm, reads as a single deliberate audit rather than incidental discovery.
One record inconsistency is worth flagging. All four descriptions open with the identical sentence: “SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability.” Three of the four are classified CWE-798, Use of Hard-coded Credentials. CVE-2026-85147 is classified CWE-284, Improper Access Control — a parent-level category — even though its own description names the same weakness as the other three. The description and the classification on that record disagree with each other.
Why it matters
Hardcoded credentials are the least sophisticated finding in the catalog and one of the most consequential, and the reason is the product category rather than the bug. Desktop management agents exist to reach every endpoint. That is the job: push software, collect inventory, run remote sessions, hold a service account with enough rights to do all of it on every machine in the fleet. A credential embedded in that agent is not a credential to one host. It is the same credential on every host the agent is installed on, and CVE-2026-85148’s phrasing — a fixed password granting remote access to user hosts — says so directly.
The four together also illustrate why a defense-in-depth story fails when the layers share a root. The AES key protecting agent communications is recoverable from the same source code as the SSH credentials it was protecting. An operator reviewing this product’s design would have found “traffic is encrypted” and “the agent authenticates over SSH” both true and both defeated by the same act of reading the binary. The scoring reflects it awkwardly: CVE-2026-85147 is the enabling weakness and carries the lowest critical-tier score in the set, because CVSS measures the direct impact of one record rather than the position it occupies in a chain.
That scoring gap is worth noting on its own. On CVE-2026-85147, v3.1 gives 7.5 and v4.0 gives 8.7 — the newer framework rates it more than a point higher. On the two 9.8 records the direction reverses: v4.0 gives 9.3, lower than v3.1’s 9.8. A program that filters on “critical” under one framework and “high” under the other will triage these four in a different order depending on which score its tooling ingested. Both scores are in the NVD record, supplied by the same CNA.
Then there is the remediation. “Update to version 11 or later” from “version 10 and earlier” is a major-version migration described in the grammar of a patch. For a fleet-wide agent, a major version change is a project: compatibility testing against the management server, a staged rollout, and a period during which some endpoints run the fixed version and some do not. Every endpoint still on version 10 during that window continues to hold credentials that are now, by virtue of this publication, publicly known to be extractable. The advisory does not state whether the version 11 upgrade rotates credentials on hosts that already have version 10 deployed, and that is the question an administrator most needs answered before scheduling the work.
On scale, honesty is required: SmartIT Desktop Manager is a Lightstar product disclosed through Taiwan’s national CERT, and neither TWCERT nor the CVE records give an install-base figure. There is no published number of affected organizations. What can be said is that the product class is one where a single compromised agent is a fleet, and that the finding came from a serious research team rather than a scanner.
What to do
- Inventory first. Determine whether SmartIT Desktop Manager is deployed anywhere in your estate and at what version. Version 10 and earlier are affected; version 11 is the fixed line.
- Assume the credentials are known. Hardcoded means the value is identical everywhere it is installed and recoverable by anyone with a copy of the application. Do not treat “we upgraded” as sufficient until you have confirmed with Lightstar whether the upgrade rotates the SSH and SFTP service account credentials on already-deployed hosts or merely stops shipping them in new code.
- Restrict the agent’s network reach in the meantime. The SSH and SFTP services on the SmartIT Agent should be reachable only from the management server. Source-restrict them at the host firewall while the upgrade is planned; an unauthenticated attacker needs network reachability to the agent’s services to use what they read out of the source.
- Search for use of those service accounts. The SSH and SFTP accounts named in CVE-2026-85146 and CVE-2026-85149 should authenticate only from the management infrastructure. Any authentication from elsewhere is worth investigating, and this is a check you can run before the upgrade lands.
- Note the record discrepancy if you ingest CWE. CVE-2026-85147 is filed under CWE-284 while its description names hardcoded credentials; if your reporting groups by CWE, that record will not sit with the other three.
Sourcing note
Checked: the TWCERT/CC advisory for SmartIT Desktop Manager, published September 4, 2026, from which the affected version range, the remediation wording, and the researcher credits are taken; the NVD records for CVE-2026-85146, CVE-2026-85147, CVE-2026-85148, and CVE-2026-85149, retrieved from the NIST CVE API on September 4, 2026, from which all descriptions, CVSS vectors, scores, and CWE classifications are taken verbatim.
Unresolved: whether Lightstar has published its own advisory — none was located, and TWCERT’s page is the primary source here. Whether upgrading to version 11 rotates credentials on hosts already running version 10, or only removes them from newly shipped code. The size of the affected install base, which neither source gives. No exploitation has been reported, the four records carry no KEV listing and no federal deadline, and the CWE mismatch on CVE-2026-85147 has not been corrected in the record as of this writing.