<img height="1" width="1" style="display: none" alt="" src="https://px.ads.linkedin.com/collect/?pid=1098858&amp;fmt=gif">

KnowledgeDeliver LMS Zero-Day Used to Deploy Stealthy In-Memory Web Shell

Explore the critical CVE-2026-5426 flaw in KnowledgeDeliver LMS exploited for remote attacks, urging immediate machine key updates.
Content Team
By Content Team

A zero-day flaw in KnowledgeDeliver LMS (CVE-2026-5426) is being actively exploited to deploy BLUEBEAM, an in-memory web shell that leaves almost no forensic trace. Mandiant linked the attacks to a late-2025 breach, finding that hardcoded ASP.NET machine keys shared across customer installations let attackers forge malicious ViewState payloads and achieve remote code execution without authentication.

Once inside, attackers weakened file permissions, tampered with JavaScript files to push fake security alerts, and infected users with a targeted Cobalt Strike Beacon. The fix is straightforward but urgent: rotate machine keys to unique values per deployment immediately.

Source: Cybersecurity News
Share this article
Share on facebook Share on linkedin Share on twitter Share on email
blog_book_a_demo_cta_3x
Have questions about protecting your software?
Our escrow experts are standing by to help.
Book a free demo
YOU MAY ALSO LIKE
Massive Supply Chain Attack on Trivy Tool Threatens Thousands of Organizations
Mar 25, 2026
Adobe Rushes Emergency Patch for Acrobat Reader Zero-Day Under Active Attack
Apr 13, 2026
Critical BitLocker Zero-Day Exploits Leave Windows Systems Exposed
May 14, 2026
M&S Technology Chief Quits Less Than a Year After Cyber Attack
Jan 22, 2026