Ethical Hacking News
A critical zero-day vulnerability has been exposed in the KnowledgeDeliver learning management system (LMS) that can be exploited by hackers to deploy malicious payloads, including the Godzilla web shell. This vulnerability highlights the need for regular security audits and updates to prevent such attacks. Organizations using the KnowledgeDeliver LMS are advised to immediately update their installations with the latest patch and take steps to secure their ASP.NET environment.
A critical zero-day vulnerability (CVE-2026-5426) has been exposed in the KnowledgeDeliver learning management system (LMS). The vulnerability can lead to remote code execution and serious breaches of sensitive data. The root cause lies in the use of identical pre-shared ASP.NET machine keys across multiple customer deployments. Hackers exploited this vulnerability to inject malicious scripts, sign ViewState payloads, and achieve remote code execution. Organizations using KnowledgeDeliver LMS are advised to update their installations with the latest patch and secure their ASP.NET environment.
In a recent development that highlights the ongoing struggle to secure our digital lives, a critical zero-day vulnerability has been exposed in the KnowledgeDeliver learning management system (LMS). This vulnerability, tracked as CVE-2026-5426, has been exploited by hackers to deploy malicious payloads, including the Godzilla web shell, which can lead to remote code execution and serious breaches of sensitive data.
The KnowledgeDeliver LMS is a popular platform used by organizations to manage employee training and development. However, the recent discovery of this zero-day vulnerability highlights the critical need for regular security audits and updates to prevent such attacks. According to Mandiant, a cybersecurity company that responded to an attack on a KnowledgeDeliver server, the vulnerability was initially exploited as a zero-day to inject a malicious script into the web platform.
The root cause of this vulnerability lies in the use of "identical pre-shared ASP.NET machine keys across multiple customer deployments." This means that even if an organization uses a unique machine key for its KnowledgeDeliver installation, it is still vulnerable to exploitation due to the widespread use of these identical keys. Mandiant notes that this vulnerability was exploited by hackers to sign malicious ViewState payloads and achieve remote code execution at the operating system level.
In a typical ViewState deserialization attack, an attacker would obtain the machine key used by the KnowledgeDeliver LMS and use it to create a malicious ViewState payload. The payload is then signed with the compromised organization's name, making it more convincing to users. Once the malicious payload is executed, it convinces users to download a fake installer, which ultimately leads to the machine getting infected with a Cobalt Strike beacon, essentially planting a backdoor.
Mandiant states that in late 2025, hackers were using this identical pre-shared ASP.NET machine keys to deploy malicious payloads. This highlights the importance of regularly updating and patching software to prevent such vulnerabilities from being exploited. The company notes that the threat actor compromised KnowledgeDeliver instances executed commands to escalate their control over the web server's file system.
This vulnerability has significant implications for organizations using the KnowledgeDeliver LMS, as it can lead to data breaches and remote code execution attacks. Organizations are advised to immediately update their KnowledgeDeliver installations with the latest patch and take steps to secure their ASP.NET environment to prevent such vulnerabilities from being exploited.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Zero-Day-Vulnerability-Exposed-The-KnowledgeDeliver-Breach-and-its-Implications-ehn.shtml
https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/
https://www.securityweek.com/hackers-exploited-knowledgedeliver-zero-day-for-web-shell-deployment/
https://nvd.nist.gov/vuln/detail/CVE-2026-5426
https://www.cvedetails.com/cve/CVE-2026-5426/
Published: Tue May 26 16:18:26 2026 by llama3.2 3B Q4_K_M
