Critical KnowledgeDeliver LMS Zero-Day Exploited to Deploy BLUEBEAM Web Shell

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-5426) in Digital Knowledge’s KnowledgeDeliver LMS is under active exploitation.
• The flaw allows unauthenticated remote code execution due to insecure ASP.NET machine key configurations.
• Attackers are deploying the stealthy, in-memory BLUEBEAM web shell and then leveraging social engineering to deliver Cobalt Strike Beacons.
• The vulnerability affects KnowledgeDeliver LMS instances using default ASP.NET configurations prior to February 24, 2026.
• Immediate remediation requires rotating ASP.NET machine keys to unique, strong values for each deployment.

KnowledgeDeliver LMS Zero-Day Under Active Exploitation

Cybersecurity researchers at Mandiant have uncovered active exploitation of a newly identified zero-day vulnerability within the KnowledgeDeliver Learning Management System (LMS). This critical flaw, designated CVE-2026-5426, enables unauthenticated remote code execution (RCE) and has been leveraged by threat actors to deploy the BLUEBEAM in-memory web shell.

The vulnerability impacts KnowledgeDeliver installations that retained default ASP.NET configuration settings prior to February 24, 2026. Digital Knowledge, a Japan-based vendor, develops the LMS, which sees widespread adoption across both corporate and educational sectors.

The Root Cause: Shared Cryptographic Keys

Mandiant’s investigation into a breach occurring in late 2025 traced the compromise to insecure cryptographic practices. Specifically, the investigation revealed that identical ASP.NET machine keys were being reused across multiple customer deployments. These keys are fundamental to securing ViewState data, a crucial mechanism in ASP.NET applications for maintaining page state across various user requests.

The hardcoded and shared nature of these machineKey values presented a significant security flaw. Once an attacker obtained these keys from a single KnowledgeDeliver instance, they could craft malicious ViewState payloads and then reuse them to compromise other vulnerable servers.

By constructing a serialized payload and injecting it via the __VIEWSTATE parameter in HTTP requests, attackers could compel the server to deserialize untrusted data. This action directly leads to remote code execution, a technique reminiscent of previously documented ViewState deserialization attacks seen in platforms like Sitecore and earlier campaigns highlighted by Microsoft involving exposed machine keys.

BLUEBEAM Web Shell and Secondary Infections

Following successful initial access, the attackers deployed BLUEBEAM, a sophisticated .NET-based web shell also known as Godzilla. Unlike traditional web shells that leave forensic artifacts on disk, BLUEBEAM operates entirely in memory within the IIS worker process (w3wp.exe), making it significantly harder to detect and investigate.

This stealthy malware communicates using encrypted HTTP POST requests, allowing threat actors to execute commands, upload additional payloads, and maintain persistence without triggering common file-based detection mechanisms.

The intrusion extended beyond server-side access. Mandiant observed the attackers manipulating file system permissions using icacls to grant overly broad access rights, thereby weakening security controls on compromised hosts. Furthermore, legitimate JavaScript files within the LMS were tampered with to inject malicious code.

This injected code displayed a deceptive security alert, prompting users to install a fraudulent authentication plugin. Simultaneously, it loaded external scripts from attacker-controlled infrastructure. This social engineering tactic led to further infections, as users who downloaded the fake plugin were subsequently infected with a Cobalt Strike Beacon payload, a widely utilized post-exploitation framework. Notably, the Cobalt Strike payload was encrypted with a key derived from the victim organization’s name, suggesting a level of targeted reconnaissance prior to the attack.

Detection and Mitigation Strategies

Detecting this activity requires vigilant monitoring of application and system behavior. Windows Application logs may contain ASP.NET Event ID 1316 entries, which can indicate ViewState validation failures or anomalies. Mandiant reported recovering encoded payload fragments from these logs, even when they generated “invalid ViewState” errors, linking them to BLUEBEAM activity.

Process monitoring is also crucial, as suspicious child processes like cmd.exe or powershell.exe spawned from w3wp.exe can signal exploitation. File integrity monitoring can reveal unauthorized modifications to .js, .aspx, or .config files, particularly the insertion of remote script loaders. Network defenders should also watch for unusual User-Agent strings, especially those formed by concatenating multiple browser signatures, a pattern consistent with previous ViewState exploitation campaigns.

What You Should Do

• Rotate ASP.NET Machine Keys: Immediately rotate ASP.NET machine keys across all KnowledgeDeliver deployments to unique, cryptographically strong values. This is the most effective remediation.
• Restrict LMS Access: Limit access to KnowledgeDeliver LMS instances to trusted IP ranges or VPNs.
• Conduct Threat Hunting: Perform retrospective threat hunting on your systems to identify any signs of compromise, looking for indicators such as the BLUEBEAM payload “LoadLibrary.dll” (SHA-256: 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2).
• Monitor Logs and Processes: Implement robust monitoring for Windows Application logs (ASP.NET Event ID 1316), suspicious child processes originating from w3wp.exe, and unusual network traffic patterns, including anomalous User-Agent strings.
• Implement File Integrity Monitoring: Monitor .js, .aspx, and .config files for unauthorized modifications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.