A newly disclosed zero-day vulnerability in the KnowledgeDeliver Learning Management System has been actively exploited in the wild to deploy the BLUEBEAM in-memory web shell, according to incident response findings published by Mandiant.
The flaw, tracked as CVE-2026-5426, enables unauthenticated remote code execution and affects all deployments that relied on default ASP.NET configuration settings before February 24, 2026.
KnowledgeDeliver, developed by Japan-based Digital Knowledge, is widely used across enterprise and educational environments throughout Japan.
Mandiant’s investigation into a late-2025 breach traced the root cause to insecure cryptographic practices, specifically, shipped with a standardized web.config file containing hardcoded machineKey values, the cryptographic secrets ASP.NET uses to encrypt and validate data, including ViewState payloads.
KnowledgeDeliver LMS 0-Day Exploited
Because these keys were identical across all customer deployments, any attacker who obtained a key from one instance could exploit any other internet-facing KnowledgeDeliver server without additional authentication.
The ASP.NET ViewState mechanism persists UI state across HTTP postbacks, and when a machineKey is known, an attacker can craft a malicious serialized ViewState payload and submit it via the __VIEWSTATE HTTP parameter, Mandiant said.
The server deserializes it, triggering arbitrary code execution. This follows the same exploitation pattern as the ViewState deserialization zero-day previously reported against Sitecore by Mandiant, and mirrors Microsoft’s February 2025 disclosure regarding publicly leaked ASP.NET machine keys being abused in the wild.
Once initial access was achieved, the threat actor prioritized persistence and the expansion of impact.
The primary post-exploitation tool was BLUEBEAM, a .NET-based in-memory web shell also known as Godzilla, which operates entirely within the IIS worker process (w3wp.exe).
Because it never writes to disk, traditional file-based antivirus and EDR scanning often miss it entirely. BLUEBEAM communicates with the attacker via encrypted HTTP POST request bodies, allowing stealthy command execution and further payload delivery.
Beyond establishing persistence, the attacker used icacls to grant “Everyone” full access permissions to the web application directory, then tampered with a JavaScript file loaded by the LMS.
This modified script displayed a convincing fake security alert urging site visitors to install a “security authentication plugin,” while simultaneously and silently loading a remote malicious script hosted on an attacker-controlled domain.
Visitors who followed the prompt downloaded a fake installer that infected their workstations with a Cobalt Strike BEACON backdoor.
Notably, the payload was encrypted with a key derived from the compromised organization’s name, confirming that the operation was specifically tailored to this target rather than an opportunistic campaign.
Defenders can identify exploitation attempts and active compromise through several methods. Windows Application Event ID 1316 is particularly valuable, as an integrity failure with event code 4009 may indicate an attempted attack with an incorrect key.
while an “invalid ViewState” result suggests the integrity check passed, and deserialization was attempted. Mandiant confirmed this by decrypting event log payload strings using the server’s own machine keys to recover BLUEBEAM artifacts.
Suspicious child processes spawned by w3wp.exe including cmd.exe, whoami, and powershell.exe are strong indicators of post-exploitation activity.
Defenders should also monitor for unauthorized modifications to .js, .aspx, or .config files in the web root, and watch HTTP access logs for anomalous concatenated User-Agent strings consistent with previous ViewState exploitation campaigns.
Affected organizations should immediately generate a unique, cryptographically strong machineKey for each KnowledgeDeliver deployment this is the only reliable way to invalidate the shared secret across all instances.
Where operationally feasible, access to the LMS should be restricted to known organizational IP ranges. Any environment showing signs of the above indicators warrants a full forensic investigation before remediation.
Indicators of Compromise
| File Name | Malware Family | SHA-256 |
|---|---|---|
| LoadLibrary.dll | BLUEBEAM | 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2 |
The KnowledgeDeliver incident reinforces a longstanding principle in secure deployment architecture: shared secrets in vendor templates create systemic risk.
A single leaked machineKey effectively becomes a universal skeleton key across an entire customer ecosystem.
Organizations deploying LMS or any ASP.NET-based platform should treat machine key rotation and uniqueness as a non-negotiable baseline security control, not an optional hardening step.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
