CVE-2026-5426

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0009.md
https://www.digital-knowledge.co.jp/product/kd/

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El valor de machineKey de ASP.NET/IIS codificado en duro en las implementaciones de Digital Knowledge KnowledgeDeliver anteriores al 24 de febrero de 2026 permite a los adversarios eludir los mecanismos de validación de ViewState y lograr la ejecución remota de código a través de ataques maliciosos de deserialización de ViewState.

Information

Published : 2026-04-16 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5426

Mitre link : CVE-2026-5426

CVE.ORG link : CVE-2026-5426

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-5426", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5426", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T17:08:59.810913Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "Digital Knowledge", "product": "KnowledgeDeliver", "versions": [{"status": "affected", "version": "0", "lessThan": "20260224", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-16T16:16:17.693", "references": [{"url": "https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability", "source": "mandiant-cve@google.com"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0009.md", "source": "mandiant-cve@google.com"}, {"url": "https://www.digital-knowledge.co.jp/product/kd/", "source": "mandiant-cve@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks"}, {"lang": "es", "value": "El valor de machineKey de ASP.NET/IIS codificado en duro en las implementaciones de Digital Knowledge KnowledgeDeliver anteriores al 24 de febrero de 2026 permite a los adversarios eludir los mecanismos de validaci\u00f3n de ViewState y lograr la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de ataques maliciosos de deserializaci\u00f3n de ViewState."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "mandiant-cve@google.com"}