Quick answers
- Is CVE-2026-85147 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85147 being exploited in the wild.
- How severe is CVE-2026-85147?
- High severity, with a CVSS score of 7.5, published 4 September 2026.
- Which products and versions are affected?
- Lightstar SmartIT Desktop Manager 10 and earlier.
- Is there a fix for CVE-2026-85147?
- A patch was published on 2026-09-04: Fix available in version 11 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85147 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-85147?
- Check whether you run Lightstar SmartIT Desktop Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a use of hard-coded credentials vulnerability in SmartIT Desktop Manager version 10 and earlier. The vulnerability exists because a specific password is embedded in the application source code; unauthenticated remote attackers with access to the application source code can extract this password and leverage it to derive the AES encryption key used to secure communication between the Desktop Manager and its agents. No authentication is required, and the vulnerability is network-accessible. Successful exploitation allows attackers to decrypt and potentially manipulate communications with managed systems. The fix is to update to SmartIT Desktop Manager version 11 or later.
Affected products
- Lightstar SmartIT Desktop Manager 10 and earlier
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix available in version 11 or later