KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

A critical vulnerability in KnowledgeDeliver LMS was exploited as a zero-day to deploy Godzilla web shell and Cobalt Strike Beacon.

• •CVE-2026-5426 (CVSS 7.5) leverages hard-coded ASP.NET machine keys for unauthenticated ViewState deserialization attacks
• •Threat actors deployed the Godzilla web shell to execute commands and grant Everyone access to the web application directory
• •Attackers modified JavaScript files to display fake security alerts and load malicious scripts from attacker-controlled domains
• •Users were tricked into downloading fake installers that delivered Cobalt Strike Beacon payloads
• •The vulnerability affected KnowledgeDeliver deployments prior to February 24, 2026, highlighting risks of shared secrets in deployment templates