Vulnerability · Published Apr 16, 2026 · Assigned by Mandiant
CVE-2026-5426KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value
Critical 9.1
In plain English
A critical-severity unsafe deserialization in KnowledgeDeliver from Digital Knowledge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digital Knowledge | KnowledgeDeliver | 0 – before 20260224 |
Weakness: CWE-321, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N