CVE-2026-5426: exploitation status and patch state

CVE-2026-5426 · CVSS 7.5 HIGH · EPSS 1%

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Is CVE-2026-5426 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-5426

• Shared MachineKey Turns One LMS Bug Into Fleet Risk (2026-05-27)

Primary sources

• NVD record

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.