Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
Brief
Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek
Introduction
In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver . KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (RCE).
An unknown threat actor leveraged this access to inject malicious code into the LMS platform, with the goal of infecting users visiting the site.
This vulnerability stems from the use of identical pre-shared ASP. NET machine keys across multiple customer deployments. The vulnerability was initially exploited as a zero-day, now tracked as CVE-2026-5426 .
The Vulnerability
KnowledgeDeliver installations deployed before Feb. 24, 2026 relied on a standardized web.