--- title: "Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability" url: https://daily.dev/posts/exploitation-of-knowledgedeliver-via-viewstate-deserialization-vulnerability-cdxn7gdbl source_url: https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability type: article source: "Google Cloud" published: 2026-05-25T05:11:17.862Z updated: 2026-08-24T06:57:39.213Z reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability **[Google Cloud](https://daily.dev/sources/gcp)** · 6 min read · 0 upvotes · 0 comments ## Summary Mandiant investigated a late-2025 compromise of KnowledgeDeliver, a Japanese Learning Management System built on ASP.NET. The root cause was CVE-2026-5426: the vendor shipped identical hardcoded ASP.NET machineKey values in all customer deployments, enabling unauthenticated RCE via crafted ViewState payloads. After gaining access, the threat actor deployed the BLUEBEAM (Godzilla) in-memory web shell inside the IIS worker process, modified JavaScript files to display fake security alerts, and ultimately infected end-user workstations with Cobalt Strike BEACON. Detection guidance covers Windows Event ID 1316, suspicious w3wp.exe child processes, file integrity monitoring, and anomalous concatenated User-Agent strings. Remediation requires immediately rotating machine keys to unique values per deployment. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- [View this post on daily.dev](https://daily.dev/posts/exploitation-of-knowledgedeliver-via-viewstate-deserialization-vulnerability-cdxn7gdbl)