The KnowledgeDeliver LMS exploit is a strong reminder that shared deployment secrets can turn one vulnerable installation into a risk for many others. The flaw, tracked as CVE-2026-5426, affects Digital Knowledge’s KnowledgeDeliver LMS and was exploited as a zero-day to achieve unauthenticated remote code execution through ASP.NET ViewState deserialization. The root issue was the use of hard-coded ASP.NET machineKey values in standardized web.config files, meaning keys obtained from one deployment could potentially be reused against other exposed instances.

This is especially serious because the attackers did not stop at server compromise. They deployed the Godzilla, also known as BLUEBEAM, web shell to execute commands and drop additional payloads, then modified application JavaScript to show a fake security alert asking users to install a “security authentication plugin.” That fake installer ultimately delivered Cobalt Strike Beacon to user machines. Naturally, the LMS meant to educate users became a malware delivery platform, because irony has apparently joined the threat model. 

Organizations using KnowledgeDeliver should immediately confirm whether their deployment existed before February 24, 2026, apply vendor fixes, rotate ASP.NET machine keys, and review web server logs for suspicious __VIEWSTATE requests, unexpected JavaScript modifications, Godzilla/BLUEBEAM web shell indicators, and Cobalt Strike activity. They should also inspect user-facing content for injected scripts and warn users not to install any plugin or tool prompted by the LMS unless verified through official IT channels.

The larger lesson is simple: default or shared secrets have no place in production software. Application vendors must generate unique cryptographic keys per deployment, and customers must monitor web applications for tampering, not just uptime. A single reused secret can convert many independent systems into one shared compromise opportunity, which is efficient only from the attacker’s point of view.

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon. The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to

Source: KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike via The Hacker News — published 26 May 2026.