CVE-2026-5426 Details
Description
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
A vulnerability exists in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026, due to a hard-coded ASP.NET machineKey value. This configuration allows adversaries to bypass ViewState validation and execute remote code by exploiting ViewState deserialization vulnerabilities. The issue arises when the default machine key is not changed, and the application is accessible over the internet.
Users are advised to generate a unique, cryptographically strong machineKey for each KnowledgeDeliver instance.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |