Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

Gbhackers •Divya • May 26, 2026

Hackers are actively exploiting a critical vulnerability in the KnowledgeDeliver Learning Management System (LMS) to deploy the BLUEBEAM web shell, according to findings from Mandiant’s Google Threat Intelligence Group. The flaw, tracked as CVE-2026-5426, enables unauthenticated remote code execution through ASP.NET ViewState deserialization and has been observed in real-world attacks. KnowledgeDeliver LMS Flaw The vulnerability […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in KnowledgeDeliver LMS Exploited by Hackers In late 2025, a critical vulnerability (CVE-2026-5426) was discovered in the KnowledgeDeliver Learning Management System, allowing unauthenticated remote code execution via ViewState deserialization. This flaw, stemming from identical ASP.NET machine keys across deployments, enabled threat actors to inject malicious code and deploy the BLUEBEAM web shell. The vulnerability has been actively exploited, impacting numerous organizations using KnowledgeDeliver, particularly in Japan. Mandiant's investigation revealed that the attackers modified JavaScript files to deceive users into downloading malicious software. The exploitation of this zero-day vulnerability poses a significant risk to users and organizations relying on this LMS. As of May 2026, the threat remains active, with ongoing attacks reported. 16 sources 70

Extracted Entities

Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)