Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

Reported 25 May 2026 by otx · Severity: medium

In late 2025, an unknown threat actor exploited a critical zero-day vulnerability in KnowledgeDeliver, a Learning Management System widely used in Japan. The vulnerability, tracked as CVE-2026-5426, allowed unauthenticated remote code execution through ViewState deserialization a