Vulnerability Report

CVE-2026-5426

RCE

Title: RCE via Hard-coded machineKey in Digital Knowledge KnowledgeDeliver

RCE

Proof Of Concept

PoC Available for CVE-2026-5426

CWE Category CWE-321

Published Date Apr 16, 2026

Modified Date May 26, 2026

Exploit Status Available

Score 9.1 CVSS v

Exploit Probability (EPSS)

0.81%

Vulnerability Summary

CVE-2026-5426: Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0009.md https://www.digital-knowledge.co.jp/product/kd/

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns