KnowledgeDeliver LMS Zero

Cybersecuritynews •Guru Baran • May 25, 2026

A newly disclosed zero-day vulnerability in the KnowledgeDeliver Learning Management System (LMS) has been actively exploited in the wild to deploy the BLUEBEAM in-memory web shell, according to Mandiant’s incident response findings. The flaw, now tracked as CVE-2026-5426, enables unauthenticated remote code execution (RCE) and affects deployments that relied on default ASP.NET configuration settings prior […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in KnowledgeDeliver LMS Exploited by Hackers In late 2025, a critical vulnerability (CVE-2026-5426) was discovered in the KnowledgeDeliver Learning Management System, allowing unauthenticated remote code execution via ViewState deserialization. This flaw, stemming from identical ASP.NET machine keys across deployments, enabled threat actors to inject malicious code and deploy the BLUEBEAM web shell. The vulnerability has been actively exploited, impacting numerous organizations using KnowledgeDeliver, particularly in Japan. Mandiant's investigation revealed that the attackers modified JavaScript files to deceive users into downloading malicious software. The exploitation of this zero-day vulnerability poses a significant risk to users and organizations relying on this LMS. As of May 2026, the threat remains active, with ongoing attacks reported. 16 sources 70

Extracted Entities

KnowledgeDeliver LMS Zero

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)