EUVD-2026-23271
GHSA-g88c-8gfj-6c98
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
10DescriptionCVE.org
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
AnalysisAI
Remote code execution in Digital Knowledge KnowledgeDeliver (all versions prior to February 24, 2026) via malicious ViewState deserialization. A hard-coded ASP.NET machineKey allows unauthenticated remote attackers to bypass ViewState validation and execute arbitrary code on the server. Mandiant reported this critical deserialization vulnerability. EPSS score of 0.08% (24th percentile) suggests low observed exploitation activity, though no public exploit is confirmed at time of analysis. CVSS vector indicates network-accessible attack requiring no privileges or user interaction, but the 7.5 score reflects only Confidentiality impact-real-world RCE capability makes this significantly more severe than the partial CVSS rating suggests.
Technical ContextAI
ASP.NET applications use ViewState to preserve page and control state across HTTP requests. ViewState integrity is protected by a machineKey-derived MAC to prevent tampering. When developers hard-code the machineKey value (defined in web.config or machine.config), all deployments share the same cryptographic secret. Attackers who discover this shared key can forge ViewState payloads containing malicious .NET serialized objects. Upon deserialization, specially crafted ObjectDataProvider or similar gadget chains trigger code execution with the privileges of the IIS application pool identity. CWE-321 (Use of Hard-coded Cryptographic Key) is the root cause-the static machineKey eliminates cryptographic uniqueness across installations. Digital Knowledge KnowledgeDeliver, a knowledge management platform running on IIS/ASP.NET, shipped with a static machineKey value until the February 2026 release, affecting all prior deployments.
RemediationAI
Upgrade to Digital Knowledge KnowledgeDeliver version released on or after February 24, 2026, which replaces the hard-coded machineKey with a deployment-unique value. Vendor patch is available per NVD records. Consult Mandiant's disclosure at https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0009.md and vendor advisory at https://www.digital-knowledge.co.jp/product/kd/ for update procedures. If immediate patching is not feasible, implement network-level access controls to restrict KnowledgeDeliver web interfaces to trusted IP ranges only-this reduces attack surface but does NOT eliminate risk from authenticated or internal attackers. Regenerating the machineKey manually in web.config provides defense-in-depth but requires coordination across all application instances and invalidates existing ViewState and authentication cookies (forcing user re-login). Monitor IIS logs for unusual POST requests with large __VIEWSTATE parameters or deserialization exceptions in event logs as potential exploitation indicators. No workaround fully mitigates the vulnerability; patching is the definitive remediation.
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today