This vulnerability arises from the use of a hard-coded cryptographic key (machineKey) in Digital Knowledge KnowledgeDeliver deployments before February 24, 2026. The hard-coded key undermines the security of ASP.NET ViewState validation, enabling adversaries to craft malicious ViewState payloads that bypass integrity checks. Successful exploitation can lead to remote code execution on the affected system. The CVSS 3.1 base score is 9.1, reflecting a critical severity with network attack vector, no privileges or user interaction required, and high confidentiality and integrity impacts. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Exploitation of this vulnerability allows remote attackers to bypass ViewState validation and execute arbitrary code on affected Digital Knowledge KnowledgeDeliver systems. This compromises the confidentiality and integrity of the application and underlying system. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider mitigating exposure by restricting network access to affected systems and monitoring for suspicious activity related to ViewState deserialization. Avoid deploying vulnerable versions where possible.