This vulnerability involves the use of a hard-coded cryptographic key (CWE-321) in the ASP.NET/IIS machineKey configuration within Digital Knowledge KnowledgeDeliver. The hard-coded key undermines the integrity of ViewState validation, allowing an attacker to craft malicious ViewState data that can be deserialized to execute arbitrary code remotely (CWE-502). The issue affects versions of KnowledgeDeliver prior to February 24, 2026. No patch or official remediation has been disclosed, and the product is not a cloud service.

Successful exploitation allows an attacker to bypass ViewState validation and achieve remote code execution on affected KnowledgeDeliver deployments. This could lead to full system compromise depending on the privileges of the application process. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider mitigating exposure by restricting access to vulnerable deployments and monitoring for suspicious activity related to ViewState manipulation. Avoid relying on default or hard-coded machineKey values in ASP.NET applications.