CVE-2026-5426

CVE-2026-5426: KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

Vendor Digital Knowledge

Product KnowledgeDeliver

Weakness CWE-321

Published April 16, 2026

Last update May 27, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Key dates

02Disclosure timeline

April 16, 2026 CVE published

May 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-5426 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/321.html

Related vulnerabilities

04Related CVE

CVE-2026-5452 UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key CVE-2026-5457 PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key CVE-2026-4477 Yi Technology YI Home Camera WPA/WPS hard-coded key CVE-2026-45041 RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery CVE-2025-15605 Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600