NPM · SEPTEMBER 2026 · EARLY WARNING

SmartIT Desktop Manager Vulnerability: Use of Hard-coded Credentials

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.8
Affected component: smartit desktop manager (npm)
Patched version: Not yet available

CVE-2026-85148

An early warning has been issued regarding a critical vulnerability in SmartIT Desktop Manager developed by Lightstar. The vulnerability involves the use of hard-coded credentials which could allow unauthenticated remote attackers to gain access to user hosts.

What happened

An early warning has been issued for a critical vulnerability in SmartIT Desktop Manager developed by Lightstar. The vulnerability, tracked as CVE-2026-85148, involves the use of hard-coded credentials. This allows unauthenticated remote attackers to exploit a fixed password to gain remote access to user hosts. The vulnerability is currently under investigation and no authoritative version range has been published yet.

The CVSS score for this vulnerability is 9.8 indicating a critical severity level. The vulnerability has not been reported as exploited in the wild at this time. Users of SmartIT Desktop Manager are advised to take immediate action to mitigate potential risks.

What to do about it

Avoid using SmartIT Desktop Manager until a patch is available.
If you must use SmartIT Desktop Manager, ensure that no hard-coded credentials are exposed.
Monitor the primary sources for updates on the vulnerability and any available patches.
Consult the NVD pages for CVE-2026-85146 and CVE-2026-85148 for the latest information.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If smartit desktop manager is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using SmartIT Desktop Manager. No authoritative version range has been published yet so it is advisable to assume all versions could be vulnerable.

What should I do right now?

Avoid using SmartIT Desktop Manager until a patch is available. If you must use it, ensure that no hard-coded credentials are exposed and monitor the primary sources for updates.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates on any available patches.

Sources

Join the 0Day waitlist →

← Back to all threats