Is CVE-2026-85148 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85148 being exploited in the wild.

How severe is CVE-2026-85148?

Critical severity, with a CVSS score of 9.8, published 4 September 2026.

Which products and versions are affected?

Lightstar SmartIT Desktop Manager 10 and earlier.

Is there a fix for CVE-2026-85148?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85148 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85148?

Check whether you run Lightstar SmartIT Desktop Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85148: Lightstar SmartIT Desktop Manager hard-coded credentials in remote access

CVE-2026-85148 · Severity: critical · CVSS 9.8 · Published 2026-09-04

SmartIT Desktop Manager is a remote desktop management tool used by system administrators to manage user computers and hosts. This vulnerability allows unauthenticated attackers from the network to gain remote access to managed user systems using a hard-coded password embedded in the application, leading to potential unauthorized system compromise and data theft.

Technologies: Lightstar SmartIT Desktop Manager. Vendors: Lightstar.

Quick answers

Is CVE-2026-85148 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85148 being exploited in the wild.
How severe is CVE-2026-85148?: Critical severity, with a CVSS score of 9.8, published 4 September 2026.
Which products and versions are affected?: Lightstar SmartIT Desktop Manager 10 and earlier.
Is there a fix for CVE-2026-85148?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85148 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85148?: Check whether you run Lightstar SmartIT Desktop Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-85148 is a Use of Hard-coded Credentials vulnerability in SmartIT Desktop Manager version 10 and earlier. The vulnerability stems from a fixed password hard-coded into the application that can be extracted and leveraged to remotely access user hosts without authentication. The attack vector is network-based with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). An unauthenticated attacker can exploit this to gain unauthorized remote access with high impact to confidentiality, integrity, and availability. The fix is to update to SmartIT Desktop Manager version 11 or later.

Affected products

Lightstar SmartIT Desktop Manager 10 and earlier

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.