In CISA KEV9.8 CriticalCWE-506
CVE-2026-8398
Daemon Tools Lite Embedded Malicious Code Vulnerability
DaemonDaemon Tools Lite
Status
- Exploited in the wild
- In CISA KEV since 27 May
- Vendor fix available
Federal deadlineSat 30 May, 23:59 UTC
Passed 147 days ago
CISA KEV · added 27 May
Exploit probabilityEPSSchecked 25 Oct
1.5%probability of exploitation in the next 30 days
Higher than 73% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 27 May · 19:35 UTC | CISA | Critical CVE‑2026‑8398 Flaw Hits Daemon Tools Lite, Exploited |
| Thu 28 May · 00:18 UTC | CISA | CISA urges action on Daemon Tools Lite CVE-2026-8398 vulnerability |
| Thu 28 May · 08:11 UTC | SecurityOnline | Showboat malware leverages critical CVEs to spy on telecoms |
| Thu 28 May · 13:31 UTC | Security Affairs | CISA warns of Daemon Tools, TanStack and Nx Console flaws |
- CISA warns of Daemon Tools, TanStack and Nx Console flawsSecurity Affairs
- Showboat malware leverages critical CVEs to spy on telecomsSecurityOnline · mentions it in passing
- CISA urges action on Daemon Tools Lite CVE-2026-8398 vulnerabilityCISA · official notice
- Critical CVE‑2026‑8398 Flaw Hits Daemon Tools Lite, ExploitedCISA · first in our coverage · official notice