Executive brief
Digital Knowledge KnowledgeDeliver, an e-learning platform used for corporate and institutional training, was found to use a hard-coded security key in its web server configuration. This flaw allows an unauthenticated attacker to bypass security validations and execute unauthorized commands on the server. An exploit could lead to a total compromise of the platform, including the theft of user data, disruption of learning services, and full control over the underlying operating system.
Technical details
KnowledgeDeliver deployments prior to February 24, 2026, utilized a pre-shared, hard-coded ASP.NET machineKey. This key is used by the IIS server to sign and encrypt ViewState data. Because the key is known, an unauthenticated remote attacker can craft a malicious serialized ViewState payload and submit it to the application. The server, using the hard-coded key, will successfully validate and deserialize the untrusted data (CWE-502), leading to OS-level remote code execution. The issue was addressed by Digital Knowledge updating their deployment procedures to ensure unique, cryptographically strong keys are generated for every instance.
Affected products
- Digital Knowledge KnowledgeDeliver Deployments prior to February 24, 2026
Timeline
- 2026-01-19: disclosed: Issue reported to Digital Knowledge by Mandiant
- 2026-02-24: patched: Digital Knowledge updated deployment procedures to address the issue
- 2026-04-16: advisory: Public disclosure of CVE-2026-5426