{"metadata": {"vulnerability": "CVE-2026-5426", "count": 41, "kinds": {"milestone": 4, "sighting": 29, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-04-02T14:20:13.588Z", "date_only": false, "value": "2026-04-02T14:20:13.588Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-5426", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-16T15:18:46.224Z", "date_only": false, "value": "2026-04-16T15:18:46.224Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5426", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-04-16T16:16:17Z", "date_only": false, "value": "2026-04-16T16:16:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G88C-8GFJ-6C98", "record": "GHSA-G88C-8GFJ-6C98", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-16T16:16:17.693Z", "date_only": false, "value": "2026-04-16T16:16:17.693", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5426", "record": "FKIE_CVE-2026-5426", "field": "published"}, {"timestamp": "2026-04-16T18:04:10.027Z", "date_only": false, "value": "2026-04-16T18:04:10.027758Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjmymffdvg2t", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "30052e01-f494-4293-958e-ac9ad3722594", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjmymffdvg2t"}, {"timestamp": "2026-04-16T18:31:22Z", "date_only": false, "value": "2026-04-16T18:31:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G88C-8GFJ-6C98", "record": "GHSA-G88C-8GFJ-6C98", "field": "published"}, {"timestamp": "2026-04-17T00:00:41.190Z", "date_only": false, "value": "2026-04-17T00:00:41.190629Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116417104416675988", "record": "cve-2026-5426", "field": "creation_timestamp", "uuid": "e5637507-72e7-47af-a93c-3ecbae40d9f9", "url": "https://infosec.exchange/users/offseq/statuses/116417104416675988"}, {"timestamp": "2026-04-17T00:00:42.440Z", "date_only": false, "value": "2026-04-17T00:00:42.440333Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjnmlvw67525", "record": "cve-2026-5426", "field": "creation_timestamp", "uuid": "450096da-30e3-4df7-ba4c-e336423215a5", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mjnmlvw67525"}, {"timestamp": "2026-04-18T05:18:34Z", "date_only": false, "value": "2026-04-18T05:18:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "a6e44065-350b-4342-bfda-925d3257a475"}, {"timestamp": "2026-05-25T07:00:00Z", "date_only": false, "value": "2026-05-25T07:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "3ad6099f-d869-4bf8-9808-b447a1a3bf8f", "url": "https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability"}, {"timestamp": "2026-05-25T07:37:14.765Z", "date_only": false, "value": "2026-05-25T07:37:14.765437Z", "kind": "sighting", "label": "Seen", "source": "https://swecyb.com/ap/users/116080658609901341/statuses/116633539838473469", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "3c9e3be4-7669-4e4a-adb1-5eebce0fddd6", "content": "(google.com) Exploitation of KnowledgeDeliver via ASP.NET ViewState Deserialization Vulnerability Leading to RCE\nCritical zero-day RCE vulnerability (CVE-2026-5426) in KnowledgeDeliver LMS exploited via ASP.NET ViewState deserialization using hardcoded machine keys. Threat actors deployed BLUEBEAM web shell and Cobalt Strike BEACON post-exploitation.\nIn brief - Mandiant uncovered a zero-day RCE flaw in Japan\u2019s KnowledgeDeliver LMS, exploited via identical hardcoded ASP.NET machine keys. Attackers used ViewState deserialization to deploy in-memory web shells and Cobalt Strike, emphasizing risks of shared cryptographic secrets.\nTechnically - CVE-2026-5426 enables unauthenticated RCE via malicious ViewState payloads due to identical `machineKey` values in `web.config`. Post-exploitation involved BLUEBEAM (in-memory IIS web shell), `icacls` privilege escalation, JavaScript file tampering, and Cobalt Strike BEACON. Detection: monitor Event ID 1316 (ViewState failures), suspicious `w3wp.exe` child processes, and anomalous User-Agents. Remediation: rotate machine keys to unique, strong values and restrict LMS access.\nSource: https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability/\n#Cybersecurity #ThreatIntel", "url": "https://swecyb.com/ap/users/116080658609901341/statuses/116633539838473469"}, {"timestamp": "2026-05-25T12:36:16.296Z", "date_only": false, "value": "2026-05-25T12:36:16.296851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmoijxbker2n", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "fc99a307-37b0-4f20-b01e-c0011341ba07", "content": "@mandiant.com\nActive exploitation of CVE-2026-5426 in KnowledgeDeliver LMS deploys BLUEBEAM web shells & Cobalt Strike.\n-\nIOCs: CVE-2026-5426, 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2\n-\n#CVE20265426 #Malware #ThreatIntel", "url": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmoijxbker2n"}, {"timestamp": "2026-05-26T03:19:38Z", "date_only": false, "value": "2026-05-26T03:19:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/05/knowledgedeliver-lms-flaw-exploited-to.html", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "6344a9c8-2efa-439d-8f37-657492850374", "content": "A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon.\n\nThe vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to", "url": "https://thehackernews.com/2026/05/knowledgedeliver-lms-flaw-exploited-to.html"}, {"timestamp": "2026-05-26T05:31:04Z", "date_only": false, "value": "2026-05-26T05:31:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/9078", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "db019d5e-8690-488f-8ba6-7e714586adf6", "content": "\ud83d\udea8 One shared key. Every deployment at risk.\n\nAttackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing systems.\n\nRead \ud83e\udc12 https://thehackernews.com/2026/05/knowledgedeliver-lms-flaw-exploited-to.html", "url": "https://t.me/thehackernews/9078"}, {"timestamp": "2026-05-26T06:10:38.589Z", "date_only": false, "value": "2026-05-26T06:10:38.589582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mmqdhd34xa2q", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "90b25872-a1b2-4e43-a791-025ebcfae9d5", "content": "CVE-2026-5426: KnowledgeDeliver LMS Targeted by Zero-Day ViewState Exploit", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mmqdhd34xa2q"}, {"timestamp": "2026-05-26T06:36:04Z", "date_only": false, "value": "2026-05-26T06:36:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/rDPiK1vGJg8wRnXGbqSk3bi_Vn49HLdYqID-Bg62JfX7ng", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "984d753b-ca50-49d8-9970-05f1ed864bd1"}, {"timestamp": "2026-05-26T07:02:46.855Z", "date_only": false, "value": "2026-05-26T07:02:46.855217Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mmqgeka5yc2c", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "2c0784ab-6050-4ed6-9e94-c1a21703c811", "content": "Une faille critique (CVE-2026-5426) dans #KnowledgeDeliver LMS, tr\u00e8s utilis\u00e9 au Japon, a permis l\u2019exploitation zero-day pour d\u00e9ployer Godzilla web shell et Cobalt Strike Beacon. Patch disponible \u26a0\ufe0f #CyberSecurity #Automatisation ", "url": "https://bsky.app/profile/calimegai.bsky.social/post/3mmqgeka5yc2c"}, {"timestamp": "2026-05-26T07:21:36.556Z", "date_only": false, "value": "2026-05-26T07:21:36.556408Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mmqhg7p55c2z", "record": "cve-2026-5426", "field": "creation_timestamp", "uuid": "681dc69e-a3cb-4cb4-b675-8e859246dbd1", "content": "Original: This article is an independent of \u201cExploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability\u201d by Takahiro Sugiyama, Peter Revelant, and Mathew Potaczek, published on the Google Cloud T\nhttps://core-jmp.org/2026/05/knowledgedeliver-viewstate-deserialization-cve-2026-5426/", "url": "https://bsky.app/profile/oxfemale.bsky.social/post/3mmqhg7p55c2z"}, {"timestamp": "2026-05-26T09:06:15.188Z", "date_only": false, "value": "2026-05-26T09:06:15.188461Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mmqnbdggm72p", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "eb709cf7-7ad7-44ca-a015-b7852182fa71", "content": "A critical vulnerability (CVE-2026-5426) in the Japanese LMS Digital Knowledge KnowledgeDeliver allowed unauthenticated remote code execution. Attackers exploited this flaw [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mmqnbdggm72p"}, {"timestamp": "2026-05-26T12:00:06.872Z", "date_only": false, "value": "2026-05-26T12:00:06.872142Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mmqwyadgzi2x", "record": "cve-2026-5426", "field": "creation_timestamp", "uuid": "23bb807c-e919-4f40-892a-f387aa28f671", "content": "\ud83d\udce2 Exploitation zero-day de KnowledgeDeliver via d\u00e9s\u00e9rialisation ViewState ASP.NET (CVE-2026-5426)\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nFin 2025, Mandia\u2026\nhttps://cyberveille.ch/posts/2026-05-26-exploitation-zero-day-de-knowledgedeliver-via-deserialisation-viewstate-asp-net-cve-2026-5426/ #ASP_NET_MachineKey #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mmqwyadgzi2x"}, {"timestamp": "2026-05-26T14:50:06Z", "date_only": false, "value": "2026-05-26T14:50:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8244", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "9c618aef-7edd-425b-bbf8-c6c5e05d1e18", "content": "\u041f\u043e\u0434\u0432\u0435\u0434 Google, Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e 0-day \u0432 KnowledgeDeliver, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432.\n\n\u0421\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435\u043c (LMS) KnowledgeDeliver, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u0430\u044f Digital Knowledge, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f, \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0432 \u042f\u043f\u043e\u043d\u0438\u0438.\n\n0-day, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2026-5426 (CVSS 7,5), \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432 \u0432\u0438\u0434\u0443 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 Digital Knowledge \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b web.config, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f machineKey, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 ASP.NET \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u043a\u043b\u044e\u0447\u0438, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0432 \u0430\u0442\u0430\u043a\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ViewState.\n\nAPP.NET ViewState \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043c\u0435\u0436\u0434\u0443 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438. \u041a\u043e\u0433\u0434\u0430 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d machineKey, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u043b\u044f ViewState. \u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u044d\u0442\u0443 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0451.\n\n\u0414\u0430\u043d\u043d\u044b\u0439 \u0442\u0438\u043f \u0430\u0442\u0430\u043a\u0438 \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u0438\u043d\u043a\u043e\u0439 \u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f \u0432 \u0445\u043e\u0434\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Sitecore\u00a0\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0439 CentreStack, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u00a0\u0430\u0442\u0430\u043a\u0430\u0445\u00a0\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 Godzilla.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Mandiant, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0443\u043b\u044f \u0432 KnowledgeDeliver \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a Godzilla (\u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u0430\u043a Bluebeam).\n\n\u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0435 \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u044d\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 Godzilla \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 JavaScript \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441 \u0446\u0435\u043b\u044c\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430 \u0438 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043b\u043e\u0436\u043d\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d.\n\n\u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u044b \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c Cobalt Strike. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043b\u044e\u0447\u043e\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438-\u0436\u0435\u0440\u0442\u0432\u044b, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mandiant \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0431\u044b\u043b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 IOCs, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0430\u0442\u0430\u043a\u043e\u0439, \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439. \u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043c\u0435\u043d\u044f\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0432\u043e\u0438\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u043c \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a LMS.\n\n\u0412\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f KnowledgeDeliver, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0434\u043e 24 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2026 \u0433\u043e\u0434\u0430, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b 0-day \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.", "url": "https://t.me/true_secator/8244"}, {"timestamp": "2026-05-26T15:59:49.484Z", "date_only": false, "value": "2026-05-26T15:59:49.484719Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mmreekkxak2q", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "4814c8d5-368c-4c80-af11-1b4b018c27c3", "content": "\ud83d\udea8 #Alerta de #Ciberseguridad: Explotaci\u00f3n Zero-Day CVE-2026-5426 en #LMS \" #KnowledgeDeliver\" www.newstecnicas.com/2026/05/aler...", "url": "https://bsky.app/profile/newstecnicas.com/post/3mmreekkxak2q"}, {"timestamp": "2026-05-26T17:08:59.810Z", "date_only": false, "value": "2026-05-26T17:08:59.810913Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5426", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-05-26T17:08:59.810Z", "date_only": false, "value": "2026-05-26T17:08:59.810913Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5426", "record": "FKIE_CVE-2026-5426", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-26T18:48:16.722Z", "date_only": false, "value": "2026-05-26T18:48:16.722Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Mandiant", "record": "CVE-2026-5426", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-26T21:31:37Z", "date_only": false, "value": "2026-05-26T21:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G88C-8GFJ-6C98", "record": "GHSA-G88C-8GFJ-6C98", "field": "modified"}, {"timestamp": "2026-05-26T22:00:27.686Z", "date_only": false, "value": "2026-05-26T22:00:27.686846Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mmryjq4to32s", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "6112ceae-6368-4b70-915a-a547c6b5b78f", "content": "Mandiant says attackers used CVE-2026-5426 in KnowledgeDeliver LMS as a zero-day to deploy Godzilla web shells, abuse reused ASP.NET machine keys, and trigger Cobalt Strike via ViewState deserialization. #KnowledgeDeliver #Mandiant #CobaltStrike", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mmryjq4to32s"}, {"timestamp": "2026-05-27T07:56:52.045Z", "date_only": false, "value": "2026-05-27T07:56:52.045931Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-486a-16a3-a903-786386626250", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "9f3a1b37-89ac-410f-9daf-14a0df049473", "content": "CVE-2026-5426: zero-day in KnowledgeDeliver LMS sfruttato per distribuire BLUEBEAM e Cobalt Strike BEACON\n@informaticaMandiant ha pubblicato i dettagli dell'exploitation attiva di CVE-2026-5426, zero-day nel LMS KnowledgeDeliver causato da chiavi ASP.NET machineKey hardcoded e condivise tra tutte le installazioni.RE: insicurezzadigitale.com/?p=977\u2026", "url": "https://poliverso.org/objects/0477a01e-486a-16a3-a903-786386626250"}, {"timestamp": "2026-05-27T07:57:03.424Z", "date_only": false, "value": "2026-05-27T07:57:03.424559Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mmszuhdmsjq2", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "de1c8b31-7a9b-414e-a2a1-c47de03eaf5f", "content": "# **CVE-2026-5426: zero-day in KnowledgeDeliver LMS sfruttato per distribuire BLUEBEAM e Cobalt Strike BEACON**\n\n\n@informatica\nMandiant ha pubblicato i dettagli dell'exploitation attiva di CVE-2026-5426, zero-day nel LMS KnowledgeDeliver causato da chiavi ASP.NET machineKey hardcoded e condivise [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mmszuhdmsjq2"}, {"timestamp": "2026-05-27T10:34:06.319Z", "date_only": false, "value": "2026-05-27T10:34:06.319794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nuke86.rfeed.it/post/3mmtcnajjkr24", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "46c0336c-5678-4faf-9289-c3a763c2be79", "content": "CVE-2026-5426: zero-day in KnowledgeDeliver LMS sfruttato per distribuire BLUEBEAM e Cobalt Strike BEACON\nil blog: insicurezzadigitale.com/cve-2026-542...\n\n#cybersecurity #apt #backdoor #cobaltstrike #infosec #malware #zeroday", "url": "https://bsky.app/profile/nuke86.rfeed.it/post/3mmtcnajjkr24"}, {"timestamp": "2026-05-27T14:53:16.313Z", "date_only": false, "value": "2026-05-27T14:53:16.313Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-5426", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-27T14:53:16.313Z", "date_only": false, "value": "2026-05-27T14:53:16.313Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5426", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-27T19:12:55.396Z", "date_only": false, "value": "2026-05-27T19:12:55.396158Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/Mozilla.activitypub.awakari.com.ap.brid.gy/post/3mmu7muiluxh2", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "021f9c9b-f2db-44bb-ba8e-1d26ee24f63a", "content": "\ud83d\udea9 Critical KnowledgeDeliver RCE (CVE-2026-5426) abused via shared ASP.NET machine keys to deliver web shells and Cobalt Strike KnowledgeDeliver exploit (CVE-2026-5426) enables RCE via ViewState ...\n\n#TIGR #malware #vulnerability\n\nOrigin | Interest | Match", "url": "https://bsky.app/profile/Mozilla.activitypub.awakari.com.ap.brid.gy/post/3mmu7muiluxh2"}, {"timestamp": "2026-05-27T21:12:27Z", "date_only": false, "value": "2026-05-27T21:12:27.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/IqAYll4ZzjxpeZQ_8CUvuT_fob3B5lJjEUBfv2EUXY56hck", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "d47dc552-4bdc-4f31-8b24-23e8a1ce21fa"}, {"timestamp": "2026-05-29T16:13:41.839Z", "date_only": false, "value": "2026-05-29T16:13:41.839400Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mmywkdlvkc27", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "49177872-221c-4d04-84fa-9190a4c57559", "content": "\ud83d\udea8 Alerta de #Ciberseguridad: Explotaci\u00f3n Zero-Day CVE-2026-5426 en LMS \"KnowledgeDeliver\" www.newstecnicas.com/2026/05/aler...", "url": "https://bsky.app/profile/newstecnicas.com/post/3mmywkdlvkc27"}, {"timestamp": "2026-05-29T23:30:05.279Z", "date_only": false, "value": "2026-05-29T23:30:05.279524Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mmzowr45uv2z", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "c9043b24-aea6-4fa2-b5db-7ee7aedd69ca", "content": "A high-severity flaw (CVE-2026-5426, CVSS 7.5) in Japan's Digital Knowledge KnowledgeDeliver LMS was exploited as a zero-day to deploy a Godzilla web shell and Cobalt Strike. Now patched.", "url": "https://bsky.app/profile/technoholic.bsky.social/post/3mmzowr45uv2z"}, {"timestamp": "2026-06-17T10:59:00.653Z", "date_only": false, "value": "2026-06-17T10:59:00.653", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5426", "record": "FKIE_CVE-2026-5426", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:33.157Z", "date_only": false, "value": "2026-06-19T12:45:33.157087Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/31ec02fb-65ac-46a6-a0c0-f704604579d7", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "01cf028d-b1e8-47cc-b826-78e536959261", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/31ec02fb-65ac-46a6-a0c0-f704604579d7"}, {"timestamp": "2026-07-21T04:00:08.515Z", "date_only": false, "value": "2026-07-21T04:00:08.515900Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/infosec_ita_notizie/2890", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "d9168ee2-0f7d-41dd-a725-342f77555c9a", "content": "\u2728 CVE-2026-5426: zero-day in KnowledgeDeliver LMS sfruttato per distribuire BLUEBEAM e Cobalt Strike BEACON\nvia, InsicurezzaDigitale.com\n\n\ud83d\udd17 Leggi di pi\u00f9: https://insicurezzadigitale.com/cve-2026-5426-zero-day-in-knowledgedeliver-lms-sfruttato-per-distribuire-bluebeam-e-cobalt-strike-beacon/", "url": "https://t.me/infosec_ita_notizie/2890"}, {"timestamp": "2026-08-29T20:00:14.725Z", "date_only": false, "value": "2026-08-29T20:00:14.725923Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/1738", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "f366e7f1-741d-42b2-8232-42563a60d19b", "content": "Attackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing systems.", "url": "https://t.me/CyberDispatch/1738"}, {"timestamp": "2026-08-31T00:00:38.263Z", "date_only": false, "value": "2026-08-31T00:00:38.263539Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/1738", "record": "CVE-2026-5426", "field": "creation_timestamp", "uuid": "83a38ad7-962e-4d23-97ff-43d823e562d5", "content": "Attackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing systems.", "url": "https://t.me/CyberDispatch/1738"}]}