NewsPublished 26 May 2026

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

Source SecurityWeek

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-5426

Description

Hardcoded machineKey values in a configuration file enabled ViewState deserialization attacks leading to remote code execution. The post Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment appeared first on SecurityWeek .

Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected KnowledgeDeliver servers, deploy persistent web shells, modify application files, and install backdoors such as Cobalt Strike. This compromises confidentiality, integrity, and availability of the LMS environment and potentially connected systems. The attack can be targeted and customized per victim, increasing risk of data breaches and further network compromise.

Defensive guidance

Mandiant recommends rotating the machineKey values in KnowledgeDeliver instances to invalidate the hardcoded keys used in attacks. Organizations should also restrict access to the LMS environment and monitor for indicators of compromise provided by Mandiant.

Summary

The KnowledgeDeliver LMS, widely used in enterprise and educational environments primarily in Japan, contains a zero-day vulnerability (CVE-2026-5426) due to hardcoded machineKey values in its standardized web.config file. These keys are used by ASP.NET for encryption and signing. Because the same machineKey is reused across deployments, attackers who know the key can craft malicious ViewState payloads that the server will deserialize, resulting in remote code execution. Exploitation led to deployment of Godzilla (Bluebeam) web shells in memory, modification of web application permissions and scripts, and installation of Cobalt Strike backdoors tailored to victim organizations.

References

securityweek.com/hackers-exploited-knowledgedeliver-zero-day-for-web-shell-deployment/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 May 2026, 11:17 UTC

References

Community reviews

Related threats