Threat actors exploited a KnowledgeDeliver zero-day vulnerability to deploy web shells and backdoors, Google-owned Mandiant reports.
A learning management system (LMS) built by Digital Knowledge, KnowledgeDeliver is widely used for enterprise and educational e-learning, mainly in Japan.
The exploited zero-day, tracked as CVE-2026-5426 (CVSS score of 7.5), existed because Digital Knowledge deployments used a standardized ‘web. config’ file that contained hardcoded ‘machineKey’ values. These keys are used by the ASP.NET framework for data encryption and signing.
The presence of the hardcoded values across independent installations allowed threat actors with knowledge of the keys to compromise other deployments by mounting ViewState deserialization attacks.
“The ASP.NET ViewState persists page state across postbacks. When the machineKey is known, a threat actor can craft a malicious ViewState payload. By sending this payload in an HTTP request, the threat actor can make the server deserialize it,” Mandiant explains.
This type of attack is not new, and was previously seen in the exploitation of Sitecore instances and CentreStack deployments, as well as in attacks involving the Godzilla post-exploitation framework.
The KnowledgeDeliver zero-day exploitation, Mandiant says, also led to the deployment of Godzilla web shells (also known as Bluebeam). Deployed in memory, the malware allows threat actors to execute additional commands and payloads on the infected machines.
The attackers used Godzilla to modify access permissions to the web application directory and to modify an application JavaScript file to load a malicious script and to display a fake security alert asking the user to install a fake plugin.
Ultimately, the systems were infected with a Cobalt Strike backdoor. Because the payload was encrypted with a key containing the victim organization’s name, Mandiant believes that the backdoor was prepared specifically for the organization.
Mandiant has provided indicators of compromise (IoCs) associated with the attack and recommends that organizations monitor their environments for potential intrusions. Organizations are also advised to rotate the machine keys for their instances and to restrict access to the LMS.
All KnowledgeDeliver deployments before February 24, 2026, are impacted by the zero-day and potentially at risk of exploitation.
Related: TrendAI Patches Apex One Zero-Day Exploited in the Wild
Related: Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days
Related: Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
Related: Researcher Drops YellowKey, GreenPlasma Windows Zero-Days
