Technical impact
The vulnerability originates from a static ASP.NET/IIS machineKey value used in Digital Knowledge KnowledgeDeliver installations before February 24 2026. Because the key is hard‑coded, attackers can forge signed ViewState payloads that bypass the framework’s validation, allowing the injection of malicious objects that are deserialized by the application. This flaw permits remote code execution on the server, making the affected environments highly vulnerable. It falls under CWE‑321 and CWE‑502.
Affected Systems
Digital Knowledge KnowledgeDeliver deployments prior to February 24 2026 are impacted. All versions of the product that rely on the hard‑coded machineKey configuration before this date are vulnerable. The flaw is tied to the web stack that includes IIS running ASP.NET, where the machineKey supplies both validation and decryption for ViewState data.
Risk and Exploitability
The flaw offers a straightforward remote exploitation path: an attacker can craft malicious ViewState and send it to any endpoint that accepts ViewState without authentication, bypassing integrity checks and triggering arbitrary code execution. No official patch or workaround is listed, the EPSS score is < 1%, and the vulnerability is not in CISA KEV. The CVSS score of 9.1 indicates high severity, and combined with the low exploitation barrier the risk remains high even though exploit activity has not been tracked publicly.
