CVE-2026-5426: Digital Knowledge Knowledgedeliver

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Affected products

• Digital Knowledge Knowledgedeliver: before 20260224 (fixed in 20260224)

Published 2026-04-16. Last modified 2026-06-17.