CVE-2026-5426

CVE

Threat entity extracted from intelligence sources

Frequency

6

occurrences

First Seen

May 25, 2026

Last Seen

May 27, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in KnowledgeDeliver LMS Exploited by Hackers69.9

In late 2025, a critical vulnerability (CVE-2026-5426) was discovered in the KnowledgeDeliver Learning Management System, allowing unauthenticated remote code execution via ViewState deserialization. This flaw, stemming from identical ASP.NET machine keys across deployments, enabled threat actors to...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical RCE Vulnerability in KnowledgeDeliver LMS Exploited by Hackers

May 25·8 sources

Related Articles (6)

Risky Bulletin: BadHost vulnerability bypasses authentication on AI infrastructure

News.Risky.Biz·May 27

5435

www.cybersecurity-help.cz·May 26

Active Exploitation of CVE-2026-5426 in KnowledgeDeliver LMS Enables Godzilla ...

Rescana·May 26

Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

Gbhackers·May 26

KnowledgeDeliver LMS Zero

Cybersecuritynews·May 25

1 / 2

Related Entities

APT41 UNC215 Malware Zero-day Exploit ViewState Deserialization Data Breach Digital Knowledge Japan CVE-2026-48710 CWE-502 - Deserialization Of Untrusted Data CWE-798 - Use of Hard-coded Credentials CWE-200 - Exposure of Sensitive Information