The use of hard-coded cryptographic keys in Digital Knowledge KnowledgeDeliver enables unauthenticated remote code execution, posing a critical security risk to affected deployments.

This vulnerability involves the use of hard-coded ASP.NET machineKey values, which permits an unauthenticated attacker to manipulate ViewState data and execute arbitrary code on the underlying server through insecure deserialization.

Successful exploitation allows an attacker to gain unauthorized remote code execution capabilities on the host server. This could lead to a full compromise of the application environment, resulting in data exfiltration, unauthorized administrative access, and potential lateral movement within the network. With a CVSS score of 7.5, this vulnerability represents a significant risk to organizational integrity and data confidentiality.

Immediate Action: Update the KnowledgeDeliver software to version 20260224 or later to remove the hard-coded cryptographic keys.

Proactive Monitoring: Review application logs for unusual ViewState patterns or serialized objects being submitted to the web interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious ViewState payloads or unauthorized deserialization attempts.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (https://github.com/HORKimhab/CVE-2026-5426).

Given the potential for remote code execution and the availability of a public proof-of-concept, this vulnerability is highly dangerous. Administrators must prioritize the installation of the vendor-provided update immediately. If the update cannot be applied instantly, ensure that the application is isolated from public-facing networks and that robust WAF filtering is in place to block malicious deserialization attempts.