KnowledgeDeliver hit by CVE-2026-5426, allowing RCE attacks

The article discusses a security incident involving the Learning Management System, KnowledgeDeliver, which was compromised due to a critical vulnerability (CVE-2026-5426) that allowed unauthenticated Remote Code Execution (RCE). This vulnerability arose from the use of identical ASP.NET machine keys across customer deployments, enabling threat actors to exploit the system and inject malicious code.

Post-exploitation activities included deploying a web shell (BLUEBEAM), modifying files to display fake alerts, and infecting users' machines with malware (Cobalt Strike). Organizations are advised to monitor for specific indicators of compromise, rotate machine keys, restrict access by IP range, and investigate any signs of exploitation. The incident highlights the risks of using shared secrets in deployments and the need for unique security measures.