KnowledgeDeliver CVE-2026-5426: Zero-Day RCE via Shared ASP.NET Machine Key

Threat actors exploited a critical zero-day vulnerability in KnowledgeDeliver, a Japanese learning management system (LMS), to deploy the Godzilla web shell and infect targeted users with Cobalt Strike. The flaw, now tracked as CVE-2026-5426, stems from a hardcoded ASP.NET machine key shared across all customer deployments.

What Happened: KnowledgeDeliver Zero-Day Enables Remote Code Execution

In late 2025, Mandiant responded to an intrusion against a web server running KnowledgeDeliver. During the investigation, researchers discovered that the platform had been shipped with identical ASP.NET machine keys across every customer deployment. Consequently, any unauthenticated attacker who obtained the key could craft malicious ViewState payloads and achieve operating-system-level remote code execution.

The threat actor leveraged this access to inject a malicious script into the LMS web portal. This script convinced visitors to download a fake security plugin, which installed a Cobalt Strike beacon on their workstations. Moreover, the attacker deployed the Godzilla (BLUEBEAM) in-memory web shell to maintain persistent access to the compromised server.

Technical Details of the KnowledgeDeliver ViewState Deserialization Vulnerability

KnowledgeDeliver installations deployed before February 24, 2026 relied on a standardized web.config file provided by the vendor. This configuration contained hardcoded machineKey values used by ASP.NET to encrypt and sign ViewState data. Because these keys were identical across independent customer environments, one compromised key put every internet-facing instance at risk.

The attack chain follows a well-documented pattern:

1. The threat actor obtains the pre-shared machine key from any source.
2. They craft a malicious ViewState payload signed with that key.
3. The payload is sent via the __VIEWSTATE HTTP parameter.
4. The server deserializes the payload, leading to remote code execution within the IIS worker process.

After gaining a foothold, the attacker performed several post-exploitation actions. They used icacls to grant full permissions to the web application directory. They also modified an application JavaScript file to display a fake security alert and silently load a remote malicious script. This script pushed a Cobalt Strike payload that was encrypted with the victim organization’s name, indicating a targeted operation.

Godzilla Web Shell and BLUEBEAM

The attacker deployed a .NET-based in-memory web shell known as Godzilla or BLUEBEAM. This malware runs entirely inside the IIS worker process (w3wp.exe), making it invisible to traditional file-based scanners. It accepts encrypted commands via HTTP POST requests, giving the attacker a stealthy command-and-control channel.

Business and Operational Impact

The compromise of an LMS platform creates cascading risks for organizations and their users:

• Data Exposure: Attackers with OS-level access can exfiltrate student records, training materials, credentials, and internal documents stored on the server.
• Endpoint Compromise: The fake installer pushed to visitors installs a Cobalt Strike beacon, giving the attacker persistent access to internal workstations.
• Lateral Movement: With both server and endpoint access, threat actors can pivot across the network, escalate privileges, and reach sensitive systems.
• Reputational Damage: Organizations using the LMS may face regulatory scrutiny and loss of trust from students, employees, or partners.

KnowledgeDeliver is widely used in Japan for corporate training and educational content. Therefore, the shared-secret deployment model exposed a broad attack surface with minimal effort required from adversaries.

Mitigation and Recommendations

Organizations running KnowledgeDeliver should take immediate action to eliminate this vulnerability and hunt for signs of exploitation.

Immediate Actions for Defenders

1. Rotate Machine Keys: Generate a unique, cryptographically strong machineKey for every KnowledgeDeliver instance. This is the only way to invalidate the shared secret.
2. Restrict Network Access: Limit LMS access to known organizational IP ranges or VPN connections where possible.
3. Investigate for Compromise: Review application event logs for Event ID 1316 from ASP.NET 4.0.30319.0. Look for viewstate integrity failures or invalid viewstate errors that may indicate exploitation.
4. Monitor Process Spawning: Alert on anomalous child processes launched by w3wp.exe, such as cmd.exe, powershell.exe, or whoami.
5. File Integrity Monitoring: Monitor JavaScript, ASPX, and config files within the web root for unauthorized modifications.

Detection Guidance

Mandiant identified anomalous User-Agent strings consisting of two distinct identifiers concatenated together. Monitor web request logs for similar patterns. Additionally, look for the following event log indicators:

• Event code 4009 with reason “Viewstate verification failed” — may indicate a failed attempt.
• Event code 4009 with reason “Viewstate was invalid” — may indicate a successful payload delivery.

Bottom line: Shared secrets in production deployments are a critical failure mode. If you run KnowledgeDeliver with a default machineKey, assume exposure and rotate immediately. Combine key rotation with active threat hunting to ensure your environment has not already been compromised.

Incident Summary

CVE ID / Incident:	CVE-2026-5426
Affected Systems:	KnowledgeDeliver LMS installations deployed before February 24, 2026 with default ASP.NET machineKey
Disclosure Date:	May 26, 2026
Patch Status:	Vendor updated deployment procedure on February 24, 2026; customers must manually generate unique machine keys
Threat Actor:	Unknown threat actor; targeted operation with organization-specific Cobalt Strike payload
Post-Exploitation Tools:	Godzilla / BLUEBEAM web shell, Cobalt Strike BEACON

References

1. Mandiant, “Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability,” Google Cloud Threat Intelligence, May 26, 2026, https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability (accessed May 26, 2026).
2. Mandiant, “MNDT-2026-0009: KnowledgeDeliver ViewState Deserialization Vulnerability,” GitHub Vulnerability-Disclosures, April 16, 2026, https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0009.md (accessed May 26, 2026).
3. Microsoft Security Blog, “Code injection attacks using publicly disclosed ASP.NET machine keys,” February 6, 2025, https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/ (accessed May 26, 2026).
4. BleepingComputer, “KnowledgeDeliver flaw exploited as a zero-day to install web shells,” May 26, 2026, https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/ (accessed May 26, 2026).