CVE-2026-5426CWE-321CWE-502

KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

Critical · published April 16, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.5th percentile
Weaknesses
CWE-321 · Use of Hard-coded Cryptographic Key; CWE-502 · Deserialization of Untrusted Data
Published
2026-04-16T15:18Z
EPSS history
Timeline
  • 16 APR 15:18Z
    KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value
    cvelistv5