# Critical KnowledgeDeliver Vulnerability Exploited in Zero-Day Attacks: Hardcoded Machine Keys Enable Web Shell Deployment
A critical vulnerability in KnowledgeDeliver, a widely-deployed learning management system, has been actively exploited by threat actors to deliver the Godzilla web shell and establish persistent backdoors on compromised servers. The flaw, tracked as CVE-2026-5426, stems from a fundamental configuration error that affected all customer deployments and required no authentication to exploit.
Mandiant, investigating an attack on a KnowledgeDeliver instance in late 2025, disclosed today that the vulnerability traces to hardcoded ASP.NET machine keys embedded in a standardized web.config file distributed to all customers. The discovery reveals a months-long exploitation window and highlights a troubling pattern: attackers with access to cryptographic keys used to sign authentication tokens have repeatedly weaponized similar flaws across enterprise platforms.
## The Threat
The vulnerability is an unauthenticated deserialization flaw that allows remote code execution at the operating system level. Threat actors who obtained the shared machine key could craft malicious ViewState payloads—encrypted data structures used by ASP.NET frameworks—that the application would trust and execute without verification.
The attack chain observed by Mandiant demonstrates the real-world danger:
Notably, Mandiant reported that the Cobalt Strike payload was encrypted using the compromised organization's name, indicating the attacker prepared this payload specifically for the targeted environment rather than conducting opportunistic scanning.
## Background and Context
KnowledgeDeliver installations deployed before February 24, 2026 relied on a standardized web.config file provided by the vendor. This configuration file contained hardcoded machineKey values—cryptographic keys used by the ASP.NET framework to encrypt and sign sensitive data structures, including ViewState payloads.
The machine key is one of the most sensitive values in an ASP.NET application. It is intended to be unique per deployment and kept confidential. Instead, KnowledgeDeliver distributed the same key across all customer instances, creating a single point of failure that affected every organization running the platform.
Timeline of exploitation:
This vulnerability was actively exploited as a zero-day, meaning attackers had working exploits before a patch became available. The exposure window likely extended several months, given the complexity of the attack and the time required for Mandiant's investigation.
## Technical Details: ViewState Deserialization Attacks
ASP.NET applications use ViewState—a serialized object that maintains page state between requests. The ViewState is encrypted and cryptographically signed using the machine key. When a request arrives, the application decrypts and deserializes the ViewState, trusting that the signature proves it has not been tampered with.
If an attacker can obtain the machine key, they can:
1. Create malicious serialized objects
2. Encrypt them using the known machine key
3. Generate a valid signature that the application will accept
4. Inject the malicious ViewState into requests
5. Achieve arbitrary code execution when the application deserializes the payload
In the KnowledgeDeliver attack, threat actors used this capability to inject code that compromised the web application itself, not just individual user accounts. This allowed them to modify the application's functionality—injecting social engineering prompts and malicious scripts—that would affect any user accessing the platform.
## How the Attack Unfolded
Phase 1: Initial Compromise
Attackers with access to KnowledgeDeliver's machine key crafted ViewState payloads designed to inject malicious JavaScript into the learning platform's web interface.
Phase 2: Social Engineering
The injected code prompted users to download and install a "security authentication plugin." Users, seeing the prompt within a trusted learning platform, had little reason to suspect it was malicious.
Phase 3: Backdoor Installation
The fake installer delivered a Cobalt Strike beacon—a remote access trojan that provides attackers with persistent command execution capabilities. The beacon was encrypted using the organization's name, suggesting the attacker conducted reconnaissance and prepared targeted payloads for specific victims.
Phase 4: Persistence and Escalation
Once the Godzilla web shell was deployed, the attacker modified application JavaScript files and executed commands to escalate control over the web server's file system. This established multiple persistence mechanisms and expanded the attack surface.
## Godzilla Web Shell: A Pattern in Motion
The Godzilla web shell (also known as BlueBeam) is a .NET-based in-memory web shell that leaves minimal forensic artifacts. It has been linked to:
The web shell's in-memory design means it is not written to disk, making detection and incident response more challenging.
## A Broader Pattern: Hardcoded Keys as a Persistent Vulnerability
This is not an isolated incident. Over the past 18 months, hardcoded or weakly protected machine keys have been weaponized against multiple enterprise platforms:
| Date | Vendor | Attack Vector | Impact |
|------|--------|----------------|--------|
| March 2025 | Gladinet CentreStack | Hardcoded machine key in ViewState | Access to secure file-sharing servers |
| July 2025 | Microsoft SharePoint | Stolen machine key | 85 servers compromised via malicious ViewState |
| 2024-2025 | Sitecore | Machine key exposure | WeepSteel reconnaissance tool deployed by state-sponsored actors |
| May 2026 | KnowledgeDeliver | Shared machine key across all deployments | Zero-day web shell deployment |
Each incident demonstrates a consistent attack pattern: obtain the cryptographic key, sign malicious payloads, achieve code execution.
## Implications for Organizations
For KnowledgeDeliver Customers:
For Enterprise Security Teams:
For Software Vendors:
## Recommendations
### Immediate Actions (KnowledgeDeliver Customers)
1. Patch immediately to a version released after February 24, 2026
2. Regenerate machine keys on all patched instances
3. Audit access logs for suspicious administrative activity or ViewState manipulation attempts
4. Scan for indicators of compromise: Godzilla web shell signatures, unexpected JavaScript in application files, Cobalt Strike beacons
5. Isolate affected systems if Godzilla or Cobalt Strike is detected
6. Reset credentials for accounts that may have accessed the compromised platform
### Ongoing Hardening (All Organizations)
## HackWire Analysis
This vulnerability exposes a critical vendor practice that has quietly persisted: distributing shared cryptographic secrets to all customers as part of default installations. The reasoning is understandable from an operational perspective—a single, standardized web.config reduces deployment complexity and support burden. The security cost is unacceptable.
What makes KnowledgeDeliver particularly dangerous is the breadth of exposure. Unlike a flaw in one company's application, this affects every organization running the platform simultaneously. An attacker with knowledge of this key can compromise dozens or hundreds of institutions across education, enterprise training, and corporate learning environments.
The broader pattern is worth noting: machine key exploitation has escalated from theoretical risk to a demonstrated, active attack vector. Mandiant's discovery of Cobalt Strike payloads tailored to specific organizations suggests this isn't opportunistic scanning—threat actors are actively hunting for ViewState deserialization targets and preparing targeted payloads. The involvement of state-sponsored actors (as seen in Sitecore attacks) indicates this technique has moved from cybercriminal toolkits into nation-state arsenals.
For defenders, the lesson is clear: cryptographic secrets in default configurations are time bombs. Whether it's machine keys in ASP.NET, default certificates, or shared API credentials, the practice of distributing identical secrets to all customers must end. Every deployment must be unique. Every key must be generated, not inherited.
The February 24, 2026 patch deadline has already passed. Organizations still running unpatched KnowledgeDeliver instances should assume compromise and treat this as an incident response scenario, not a routine vulnerability update.
— HackWire Editorial
## Related Coverage