KnowledgeDeliver flaw exploited as zero-day to deploy web shells
Summary
Mandiant reported zero-day exploitation of CVE-2026-5426 in KnowledgeDeliver LMS servers. Attackers abused shared ASP.NET machine keys to achieve remote code execution, deploy Godzilla, and deliver Cobalt Strike through fake software prompts.
Key points
- Mandiant reported that attackers exploited CVE-2026-5426 as a zero-day against KnowledgeDeliver LMS servers.
- The unauthenticated ViewState deserialization flaw was enabled by shared hardcoded ASP.NET machine keys in older deployments.
- Attackers used the keys to sign malicious ViewState payloads and achieve operating-system-level remote code execution.
- Mandiant found the Godzilla in-memory web shell on compromised servers.
- Attackers modified application JavaScript to prompt users to install a fake security plugin and load a malicious script.
- The fake installer led to a Cobalt Strike beacon; Mandiant said the payload was tailored to the targeted organization.
Article Details
- Vulnerability Types
- ViewState deserialization
- Hardcoded shared ASP.NET machine key
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
MITRE ATT&CK
T1059.007 · JavaScriptThe attackers modified an application JavaScript file to prompt users to install a fake security plugin and load a malicious script.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-5426 in KnowledgeDeliver LMS servers without authentication to achieve remote code execution.T1204.002 · Malicious FileUsers were prompted to download a fake installer, which led to a Cobalt Strike beacon infection.T1505.003 · Web ShellThe attackers deployed the Godzilla in-memory web shell on compromised KnowledgeDeliver servers.
CVE
Malware
BlueBeamBlueBeam), which has also been used in similar attacks observed by Microsoft in late 2024.GodzillaMandiant reported that attackers exploited CVE-2026-5426 in KnowledgeDeliver LMS servers as a zero-day to deploy the Godzilla web shell and gain remote code execution through ViewState deserialization.