# CVE-2026-5426: RCE via ViewState Deserialization in KnowledgeDeliver

> Attackers exploit CVE-2026-5426 in the KnowledgeDeliver LMS to achieve RCE via shared ASP.NET machine keys. Immediate key rotation and patching are required.

- Published: 2026-05-25T05:38:56.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: CVE-2026-5426, KnowledgeDeliver, BLUEBEAM, RCE, ViewState, Digital Knowledge
- Author: Runtime Rebel Intel
- Primary source: https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability/
- Canonical: https://runtimerebel.com/blog/cve-2026-5426-rce-via-viewstate-deserialization-in-knowledgedeliver

## Key points

- Unauthenticated attackers can execute arbitrary code to compromise servers and infect site visitors with Cobalt Strike malware.
- Digital Knowledge KnowledgeDeliver Learning Management System installations deployed before February 24, 2026.
- Administrators must immediately rotate the ASP.NET machine keys to unique, cryptographically strong values for every instance.

According to [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability/), security researchers recently identified a critical [RCE](/glossary#rce) vulnerability in KnowledgeDeliver, a Learning Management System (LMS) developed by Digital Knowledge and widely used within Japan. This flaw, tracked as [CVE-2026-5426](https://nvd.nist.gov/vuln/detail/CVE-2026-5426), allows unauthenticated attackers to execute code by exploiting a [Zero-Day](/glossary#zero-day) deserialization flaw. The issue stems from a systemic [Supply Chain Attack](/glossary#supply-chain-attack) risk where the vendor provided a standardized `web.config` file containing identical pre-shared ASP.NET machine keys across multiple customer environments.

### Technical Analysis of ViewState Deserialization
The [CVE](/glossary#cve) exists because KnowledgeDeliver installations deployed prior to February 2026 relied on a hardcoded `machineKey` configuration. In the ASP.NET framework, these keys are used to encrypt and sign the ViewState, which maintains page state during postbacks. Since these keys were not unique, a threat actor who recovered the keys from one instance could generate a malicious ViewState payload compatible with any other internet-facing installation.

Upon sending a crafted `__VIEWSTATE` parameter in an HTTP request, the server attempts to deserialize the data. Because the signature (generated using the known pre-shared key) is valid, the server processes the payload, leading to arbitrary code execution. This [TTP](/glossary#ttp) mirrors previous high-profile attacks against other platforms and underscores the danger of static credentials in deployment templates.

### Post-Exploitation and Malware Deployment
Once initial access is achieved, the threat actor utilizes a specific set of tools to maintain persistence. Mandiant observed the deployment of a .NET-based in-memory web shell known as BLUEBEAM (also known as Godzilla). This malware operates within the IIS worker process (`w3wp.exe`), effectively evading [EDR](/glossary#edr) solutions that rely solely on file-system scanning.

Following the web shell deployment, attackers were observed performing file tampering. This included using `icacls` to grant broad permissions to web directories and modifying application JavaScript files. The modified scripts were designed to display fraudulent security alerts, tricking users into downloading a "security authentication plugin." This plugin served as a delivery mechanism for a workstation infection involving Cobalt Strike BEACON, which allowed for persistent [C2](/glossary#c2) communications.

## How to detect CVE-2026-5426 exploit
Defenders must actively hunt for [IoC](/glossary#ioc) markers within their environments. One primary detection method involves monitoring Windows Application Event Logs for Event ID 1316. An event code of 4009 indicating "Viewstate verification failed" with the reason "Viewstate was invalid" is a strong indicator that an integrity check passed—meaning the attacker used the correct key—but the subsequent deserialization attempt failed or triggered an error.

Additionally, [SOC](/glossary#soc) teams should monitor for suspicious child processes spawned by `w3wp.exe`. The execution of `cmd.exe`, `whoami`, or `powershell.exe` from the IIS worker process is highly anomalous and should be investigated immediately. Analyzing [SIEM](/glossary#siem) logs for User-Agent strings featuring concatenated browser identifiers—a known trait of the exploitation tools used in these campaigns—is another effective strategy.

### KnowledgeDeliver ViewState deserialization mitigation steps
The primary remediation for this vulnerability is the immediate rotation of ASP.NET machine keys. Organizations must generate a unique, cryptographically strong key for every individual KnowledgeDeliver instance to invalidate the shared vendor default. Following this, administrators should conduct a thorough compromise assessment to ensure no web shells or modified JavaScript files remain in the web root. 

Restricting access to the LMS via IP address whitelisting can further reduce the attack surface. However, given the nature of the infection chain—where visitors are targeted—cleaning the web server environment remains the highest priority for defenders.

**Related:** [April 2026 Patch Tuesday: SharePoint Zero-Day, BlueHammer, & Adobe RCE](/blog/april-2026-patch-tuesday-sharepoint-zero-day-bluehammer-adobe-rce), [PAN-OS RCE via CVE-2024-0012: Palo Alto Networks Exploitation Guide](/blog/pan-os-rce-via-cve-2024-0012-palo-alto-networks-exploitation-guide)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-5426-rce-via-viewstate-deserialization-in-knowledgedeliver