CVE-2026-5426: KnowledgeDeliver LMS Targeted by Zero-Day ViewState Exploit

Hard-coded ASP.NET machine keys in KnowledgeDeliver LMS have enabled unauthenticated RCE attacks. Threat actors deployed the BLUEBEAM in-memory web shell and t…

A now-patched vulnerability in the KnowledgeDeliver Learning Management System (LMS), identified as CVE-2026-5426 with a CVSS score of 7.5, has been actively exploited as a zero-day to achieve unauthenticated remote code execution (RCE).

The attack vector utilizes malicious deserialization of the ASP.NET __VIEWSTATE parameter.

According to Google Mandiant and the Google Threat Intelligence Group, the attack chain allowed threat actors to deploy in-memory web shells and distribute Cobalt Strike malware directly to end-users.

The stakes extend beyond a single product: the vulnerability affects installations deployed prior to February 24, 2026. The flaw stems from hard-coded machineKey values within a standardized web.config file, which was replicated across a potentially large number of installations using the same template.

Key Takeaways

CVE-2026-5426 affects KnowledgeDeliver versions prior to February 2026: Hard-coded ASP.NET keys allow unauthenticated RCE via ViewState deserialization.
Attackers deployed BLUEBEAM, a .NET web shell based on the Godzilla framework that resides exclusively in the memory of the IIS w3wp.exe process, evading file-based detection.
Legitimate JavaScript files were modified to display fraudulent security alerts, directing users to a malicious plugin used to deliver Cobalt Strike Beacons.
The Cobalt Strike payloads were encrypted with keys derived from the specific target organization's name, indicating highly targeted operations rather than mass exploitation.

Systemic Risk: How Template-Shared Keys Expose Distributed Instances

The mechanism behind CVE-2026-5426 is not a complex bug chain, but rather an architectural oversight with severe security implications. The web.config file distributed with KnowledgeDeliver contained default machineKey values identical across all installations.

In the ASP.NET framework, these keys are used to sign and encrypt the ViewState—a hidden field that maintains page state between HTTP requests.

When an attacker possesses these keys, they can craft arbitrary serialized payloads, inject them into the __VIEWSTATE parameter, and execute code on the server with the privileges of the w3wp.exe worker process.

The standardized nature of the deployment amplifies the impact: once a key is extracted from a single instance, the attack becomes replicable across every other installation sharing that template.

Technical analysis suggests this characteristic acts as a systemic risk multiplier, converting isolated vulnerabilities into a distributed attack surface.

Installations deployed before February 24, 2026, are considered vulnerable; it remains unclear how many organizations have successfully applied the necessary patches in the intervening months.

BLUEBEAM: The In-Memory Stealth Web Shell

Following initial execution, attackers deployed a web shell based on the Godzilla framework, identified in this campaign as BLUEBEAM.

Its primary characteristic is the absence of persistent artifacts on the file system. The entire payload operates within the Internet Information Services (IIS) w3wp.exe process, communicating via encrypted HTTP POST requests.

This in-memory operation drastically reduces detection opportunities for endpoint security tools that rely on monitoring suspicious file creation.

Technical sources identify the file LoadLibrary.dll as the delivery vehicle for the BLUEBEAM payload, carrying the SHA-256 hash: 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2.

During post-exploitation, attackers also utilized icacls to modify filesystem permissions, ensuring broad access to the web application directory and solidifying operational persistence beyond the initial memory injection.

From Server to User: Escalating RCE to Mass Compromise

The most insidious element of this campaign is the pivot from server compromise to the manipulation of end-users.

Threat actors altered legitimate LMS JavaScript files to inject code that triggered fake security warnings. These alerts prompted users to install an "authentication plugin" purportedly required to continue using the platform.

This social engineering tactic exploited the existing trust between users and their host institution. Users saw a familiar domain and an interface that mimicked corporate security conventions before being redirected to an installer hosted on attacker-controlled infrastructure.

Once executed, the vehicle delivered a Cobalt Strike Beacon, a commercially available post-exploitation tool widely favored by advanced threat actors.

According to Google researchers: "the payload was encrypted using a key that used the name of the compromised organization, which indicated that the threat actor prepared this payload specifically for the targeted organization."

"An unknown threat actor leveraged this access to inject malicious code into the LMS platform, with the goal of infecting users visiting the site." — Google Mandiant and Google Threat Intelligence Group, via The Hacker News

Remediation and Response

For organizations utilizing KnowledgeDeliver LMS, the immediate priority is verifying patch status and hunting for indicators of past compromise.

Operational recommendations focus on four critical actions:

Verify deployment dates and apply patches. Any installation deployed prior to February 24, 2026, must be considered vulnerable. Organizations should update to the latest version and immediately rotate machineKey values with unique, cryptographically secure strings for every instance.

Hunt for BLUEBEAM indicators. Monitor for the LoadLibrary.dll file (SHA-256: 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2) and analyze Windows Application logs for Event ID 1316. This ID signals ASP.NET ViewState validation failures, which may indicate past or ongoing exploitation attempts.

Inspect w3wp.exe child processes. Because BLUEBEAM operates in-memory within the IIS worker process, the presence of anomalous child processes or suspicious network connections originating from w3wp.exe is a critical indicator of compromise, even if no malicious files are present on disk.

Audit LMS JavaScript integrity. Review JavaScript files within the application directory for unauthorized modifications, specifically focusing on code that loads external resources or triggers unexpected security prompts. Warn users against installing unverified plugins, even if prompted by institutional platforms.

The Core Issue: Templates as Attack Vectors

The campaign against KnowledgeDeliver is not a case of isolated administrative negligence but a systemic failure of a deployment template that incorporates shared secrets. While common in enterprise software to simplify installation, this model creates transitive security dependencies.

The compromise of one instance effectively leads to the potential compromise of all.

Google Mandiant and GTIG emphasized this risk with a warning that applies far beyond this specific product: "The exploitation of KnowledgeDeliver highlights the severe risks of using shared secrets in deployment templates. A single leaked key can compromise an entire ecosystem of installations."

This lesson is applicable to any platform—from containerized cloud environments to IoT systems—that distributes default credentials, API keys, or cryptographic parameters in standardized packages.

Furthermore, the use of Cobalt Strike with organization-specific encryption suggests an actor investing in targeted preparation rather than opportunistic mass exploitation. This elevates the threat profile: targets are not selected at random but are chosen for the value of the access provided by an institutional LMS.

Frequently Asked Questions

Why is the BLUEBEAM web shell particularly difficult to detect?: It operates entirely within the memory of the w3wp.exe IIS process without writing persistent files to disk. Traditional security tools that rely on filesystem scanning may miss it; detection requires process behavior monitoring, network analysis, and auditing Windows Application logs for Event ID 1316.
What differentiates CVE-2026-5426 from typical web vulnerabilities?: The root cause is not a coding error in the application logic, but a hard-coded cryptographic key within a standardized deployment template released before February 24, 2026. This means the same key (CVSS 7.5) may exist across every installation using that template, allowing for cross-instance exploitation without the need for per-target reconnaissance.
Can end-users protect themselves?: Users should treat any request to install plugins or security updates within a web platform with extreme suspicion, even if the domain appears legitimate. Always verify such requests with the IT department before downloading software, particularly when the alert conveys a sense of urgency.