CRITICALCVE-2026-5426Published Modified CNA Mandiant
CVE-2026-5426: KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
Metrics
- CVSS v3.1
- 9.1
- Severity
- CRITICAL
- Fixed in
- 20260224
- Affected Products
- 1
Fix available
20260224
Affected packages
- Digital Knowledge / KnowledgeDeliver< 20260224 (from 0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N