TLDR Tech / InfoSec
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
An unknown threat actor exploited CVE-2026-5426 as a zero-day, abusing hardcoded ASP.NET machineKey values shipped identically across pre-February KnowledgeDeliver LMS deployments to forge malicious ViewState payloads and achieve unauthenticated RCE. Post-exploitation, the actor deployed the in-memory BLUEBEAM (Godzilla) web shell inside w3wp.exe, used icacls to grant "Everyone" full access to the web root, and tampered with an application JavaScript file to serve a fake security plugin that delivered an organization-specific Cobalt Strike BEACON. Defenders should rotate machine keys to unique per-instance values, restrict LMS access by IP, and hunt for Application Event ID 1316 ViewState failures, anomalous w3wp.exe child processes, web-root, .js/.aspx/.config tampering, and concatenated dual-identifier User-Agent strings.
Read the full story