CVE-2026-5426: Digital Knowledge KnowledgeDeliver hard-coded machineKey ViewState deserialization RCE
CVE-2026-5426 describes a hard-coded ASP.NET/IIS machineKey in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026. According to the record, this allows attackers to bypass ViewState validation and achieve remote code execution through malicious ViewState deserialization. The CVSS 3.1 base score of 9.1 is listed as critical, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-5426 affects Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026. The record describes a hard-coded ASP.NET/IIS machineKey value that undermines ViewState validation. The issue was published on April 16, 2026 by Google's Mandiant CNA and the record is currently awaiting NVD analysis.
Impact
- The record states that the flaw allows remote code execution through malicious ViewState deserialization.
- The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact.
- The CWE classification is CWE-321 (use of hard-coded cryptographic key).
Affected products and versions
- Product: Digital Knowledge KnowledgeDeliver.
- Affected range as described: deployments prior to February 24, 2026.
- The record does not provide a structured list of affected versions or fixed builds.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the vendor page and the Mandiant disclosure for update guidance: Mandiant advisory and Google Cloud blog.
- Inventory any KnowledgeDeliver instances and confirm their deployment dates against the February 24, 2026 threshold.
- Because the root cause is a hard-coded key, a fix generally requires the vendor's update or a documented configuration change that replaces the machineKey. Confirm the exact remedy with the vendor.
- Restrict network exposure of affected web applications until remediation is verified.
Detection guidance
- Review web server and application logs for unusual or unexpected POST requests carrying ViewState data, and for unexpected process activity spawned by the web application worker.
- Monitor for anomalous errors from ViewState deserialization in application logs.
Limitations of the available information
- The record does not include fixed versions, a vendor advisory text, or the exact list of affected builds.
- The CVSS source is a third-party provider identifier and the NVD analysis is pending.
- EPSS values are included in the record, but they are a probabilistic estimate and not evidence of exploitation.
Frequently asked questions
What is the core problem in CVE-2026-5426?
The record describes a hard-coded ASP.NET/IIS machineKey in KnowledgeDeliver deployments, which can let attackers bypass ViewState validation and reach remote code execution through malicious ViewState deserialization.
Is this vulnerability known to be actively exploited?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record describes deployments prior to February 24, 2026, but it does not provide a structured list of affected or fixed versions. Confirm with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.