Vulnerabilities

CVSS

9.1 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Risk score

72.8

Published

2026-04-16

Status

Awaiting Analysis

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Weaknesses

CWE-321CWE-502

Coverage 3

vulnerability

KnowledgeDeliver flaw exploited as a zero-day to install web shells

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell.

BleepingComputer · May 26, 2026 Critical

CVE-2026-5426

vulnerability

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

Hardcoded machineKey values in a configuration file enabled ViewState deserialization attacks leading to remote code execution. The post Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment appeared first…

SecurityWeek · May 26, 2026 Critical

CVE-2026-5426

threat-intel

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

A zero-day vulnerability in Digital Knowledge KnowledgeDeliver LMS was exploited to deploy the Godzilla web shell and establish Cobalt Strike Beacon access. The flaw, stemming from hard-coded ASP.NET machine keys, allowe…

The Hacker News · May 26, 2026 Critical

CVE-2026-5426JPzero-daydeserializationasp.net

All articles mentioning it

Advisories and references

• cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-vi...
• github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-...
• digital-knowledge.co.jp/product/kd/