CVE-2026-8398 (GCVE-0-2026-8398)

Vulnerability from cvelistv5 – Published: 2026-05-15 07:30 – Updated: 2026-11-11 15:28
VLAI CISA Previdian
Summary
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 00:00 UTC
CWE
  • CWE-506 - Embedded Malicious Code
Assigner
Kaspersky CNA under the mitre root
CNA scorecard C 74/100 over 10 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
AVB Disc Soft DAEMON Tools Lite Affected: 12.5.0.2421 , < 12.6.0.* (semver)
guessed Create a notification for this product.
Credits
Igor Kuznetsov (Kaspersky) Georgy Kucherin (Kaspersky) Leonid Bezvershenko (Kaspersky) Anton Kargin (Kaspersky)
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 11739434-0930-4569-82cd-80d659d1039f

Vulnerability ID: CVE-2026-8398

Status: Confirmed

Status Updated: 2026-05-27 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2026-05-27
Asserted: 2026-05-27
Scope
Notes: Daemon Tools Lite Embedded Malicious Code Vulnerability | Affected: Daemon / Daemon Tools Lite | Description: Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-05-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://blog.daemon-tools.cc/post/security-incident ; https://nvd.nist.gov/vuln/detail/CVE-2026-8398
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-506
Feed CISA Known Exploited Vulnerabilities Catalog
Product Daemon Tools Lite
Due Date 2026-05-30
Date Added 2026-05-27
Vendorproject Daemon
Vulnerabilityname Daemon Tools Lite Embedded Malicious Code Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-05-27 18:00 UTC | Updated: 2026-11-04 13:01 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 12d3ead8-7852-4708-b0a5-2eb031bea199

Vulnerability ID: CVE-2026-8398

Status: Confirmed

Status Updated: 2026-05-27 18:00 UTC

Exploited: Yes

Timestamps
First Seen: 2026-05-27
Asserted: 2026-05-27
Scope
Notes: KEVIntel entry: A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434),... | Affected: AVB Disc Soft / DAEMON Tools Lite | CVSS: 9.3 (CRITICAL) | EPSS: 0.00754 | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434),...
Vendor AVB Disc Soft
Product DAEMON Tools Lite
Added Date 2026-05-27T18:00:02.449Z
Cvss Score 9.3
Epss Score 0.00754
Cvss Severity CRITICAL
Epss Percentile 0.50205
Used In Malware unknown
Ahead Of Cisa Kev 
{
  "count": 6,
  "unit": "day"
}
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8398",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-27",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T03:55:20.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-27T00:00:00.000Z",
            "value": "CVE-2026-8398 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "DAEMON Tools Lite",
          "vendor": "AVB Disc Soft",
          "versions": [
            {
              "lessThan": "12.6.0.*",
              "status": "affected",
              "version": "12.5.0.2421",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Kuznetsov (Kaspersky)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Georgy Kucherin (Kaspersky)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Leonid Bezvershenko (Kaspersky)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Anton Kargin (Kaspersky)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor\u0027s (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T15:28:05.468Z",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "name": "DAEMON Tools software infected \u2013 supply chain attack ongoing since April 8, 2026",
          "tags": [
            "technical-description",
            "third-party-advisory"
          ],
          "url": "https://securelist.com/tr/daemon-tools-backdoor/119654/"
        },
        {
          "name": "Security Incident Affecting DAEMON Tools Lite: What We Know So Far",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://blog.daemon-tools.cc/post/security-incident"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Users of potentially infected application are recommended to uninstall the application, run a full system scan using antivirus software with the latest version of the anti-virus databases, and install the latest version of DAEMON Tools Lite (12.6 or newer) from the official website."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-06T00:00:00.000Z",
          "value": "Advisory published by vendor"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2026-8398",
    "datePublished": "2026-05-15T07:30:29.287Z",
    "dateReserved": "2026-05-12T13:20:16.358Z",
    "dateUpdated": "2026-11-11T15:28:05.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-8398",
      "cwes": [
        "CWE-506"
      ],
      "dateAdded": "2026-05-27",
      "dueDate": "2026-05-30",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://blog.daemon-tools.cc/post/security-incident ; https://nvd.nist.gov/vuln/detail/CVE-2026-8398",
      "product": "Daemon Tools Lite",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.",
      "vendorProject": "Daemon",
      "vulnerabilityName": "Daemon Tools Lite Embedded Malicious Code Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-8398",
      "date": "2026-11-13",
      "epss": "0.01456",
      "percentile": "0.73899"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Windows"
                ],
                "product": "DAEMON Tools Lite",
                "vendor": "AVB Disc Soft",
                "versions": [
                  {
                    "lessThan": "12.6.0.*",
                    "status": "affected",
                    "version": "12.5.0.2421",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "vulnerability@kaspersky.com"
          }
        ],
        "cisaActionDue": "2026-05-30",
        "cisaExploitAdd": "2026-05-27",
        "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Daemon Tools Lite Embedded Malicious Code Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:disc-soft:daemon_tools:12.5.1:*:*:*:lite:*:*:*",
                    "matchCriteriaId": "F291E275-397E-40E4-8ABD-292B16A8C90E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor\u0027s (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection."
          },
          {
            "lang": "es",
            "value": "Un ataque a la cadena de suministro comprometi\u00f3 los paquetes de instalaci\u00f3n oficiales de DAEMON Tools Lite (versiones de Windows 12.5.0.2421 a 12.5.0.2434), distribuidos desde el sitio web leg\u00edtimo daemon-tools.cc entre aproximadamente el 8 de abril de 2026 y el 5 de mayo de 2026. Los atacantes obtuvieron acceso no autorizado a la infraestructura de compilaci\u00f3n o distribuci\u00f3n del proveedor (AVB Disc Soft) y troyanizaron tres binarios: DTHelper.exe, DiscSoftBusServiceLite.exe y DTShellHlp.exe. Estos archivos fueron firmados digitalmente con el certificado de firma de c\u00f3digo leg\u00edtimo de AVB Disc Soft, lo que permiti\u00f3 que los instaladores maliciosos parecieran confiables y eludieran la detecci\u00f3n basada en firmas."
          }
        ],
        "id": "CVE-2026-8398",
        "lastModified": "2026-11-11T16:17:25.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "vulnerability@kaspersky.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "vulnerability@kaspersky.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-8398",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-15T09:16:17.653",
        "references": [
          {
            "source": "vulnerability@kaspersky.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://blog.daemon-tools.cc/post/security-incident"
          },
          {
            "source": "vulnerability@kaspersky.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://securelist.com/tr/daemon-tools-backdoor/119654/"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
          }
        ],
        "sourceIdentifier": "vulnerability@kaspersky.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-506"
              }
            ],
            "source": "vulnerability@kaspersky.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-16T07:56:57+00:00",
      "cve": "CVE-2026-8398",
      "id": "CVE-2026-8398",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-8398",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8398.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-8398",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-27T17:50:18.985850Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-05-27",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-15T13:27:56.721Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-05-27T00:00:00.000Z",
                "value": "CVE-2026-8398 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Windows"
              ],
              "product": "DAEMON Tools Lite",
              "vendor": "AVB Disc Soft",
              "versions": [
                {
                  "lessThan": "12.6.0.*",
                  "status": "affected",
                  "version": "12.5.0.2421",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Igor Kuznetsov (Kaspersky)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Georgy Kucherin (Kaspersky)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Leonid Bezvershenko (Kaspersky)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Anton Kargin (Kaspersky)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor\u0027s (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "cvssV4_0": {
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-506",
                  "description": "CWE-506: Embedded Malicious Code",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-11T15:28:05.468Z",
            "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
            "shortName": "Kaspersky"
          },
          "references": [
            {
              "name": "DAEMON Tools software infected \u2013 supply chain attack ongoing since April 8, 2026",
              "tags": [
                "technical-description",
                "third-party-advisory"
              ],
              "url": "https://securelist.com/tr/daemon-tools-backdoor/119654/"
            },
            {
              "name": "Security Incident Affecting DAEMON Tools Lite: What We Know So Far",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://blog.daemon-tools.cc/post/security-incident"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Users of potentially infected application are recommended to uninstall the application, run a full system scan using antivirus software with the latest version of the anti-virus databases, and install the latest version of DAEMON Tools Lite (12.6 or newer) from the official website."
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-05-06T00:00:00.000Z",
              "value": "Advisory published by vendor"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "assignerShortName": "Kaspersky",
        "cveId": "CVE-2026-8398",
        "datePublished": "2026-05-15T07:30:29.287Z",
        "dateReserved": "2026-05-12T13:20:16.358Z",
        "dateUpdated": "2026-11-11T15:28:05.468Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Solutions

CNA · Kaspersky
Users of potentially infected application are recommended to uninstall the application, run a full system scan using antivirus software with the latest version of the anti-virus databases, and install the latest version of DAEMON Tools Lite (12.6 or newer) from the official website.

Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.