Loading story…
Google Cloud's Mandiant Threat Intelligence reported exploitation of the KnowledgeDeliver platform through an ASP.NET ViewState deserialization vulnerability, indicating attackers were able to abuse insecure server-side handling of serialized state data to achieve code execution on exposed systems. The issue affects deployments where ViewState protections were improperly configured or bypassed, turning a common web application mechanism into an entry point for compromise.
The report highlights the risk to organizations running internet-facing KnowledgeDeliver instances, where successful exploitation could allow unauthorized access, remote command execution, and follow-on intrusion activity. Defenders were urged to identify exposed systems, review application and web server logs for suspicious requests tied to ViewState processing, validate hardening of ASP.NET cryptographic settings, and apply vendor guidance or mitigations to prevent further exploitation.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant Threat Intelligence blog published a report on exploitation of a ViewState deserialization vulnerability affecting KnowledgeDeliver. The reference provides no additional incident details, dates, victims, or remediation milestones beyond the publication itself.
KnowledgeDeliver deployments using default ASP.NET settings prior to 2026-02-24 were vulnerable to unauthenticated RCE via forged ViewState payloads because identical hardcoded machine keys were reused across customer instances. Mandiant later linked post-exploitation activity to BLUEBEAM web shell deployment, JavaScript tampering, and Cobalt Strike delivery, and advised defenders to rotate machine keys and hunt for published indicators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft warned that attackers are actively using publicly disclosed ASP.NET `machineKey` values to achieve remote code execution on vulnerable IIS-hosted ASP.NET applications. The attacks abuse exposed static `validationKey` and `decryptionKey` values to generate malicious ViewState payloads with valid message authentication codes, allowing the ASP.NET runtime to accept and execute attacker-controlled data. Microsoft said the activity has been observed since at least December 2024 and linked some intrusions to deployment of the **Godzilla** post-exploitation framework. The company identified more than 3,000 leaked keys and released their hashes in a CSV file so organizations can check whether their environments are exposed. Guidance from Microsoft and CSIRT.SK urges defenders to replace any public or default keys, protect sensitive `web.config` elements through encryption, upgrade ASP.NET to at least version **4.8**, and further harden Windows and IIS servers to reduce the risk of malware deployment and follow-on compromise.
Jul 24, 2026
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026
Microsoft has addressed a critical security vulnerability in the Kestrel web server component of ASP.NET Core, tracked as CVE-2025-55315, which received a CVSS severity score of 9.9—the highest ever assigned by Microsoft to a flaw in this framework. The vulnerability enables HTTP request smuggling, a technique where an attacker can embed a malicious request within a legitimate one, potentially bypassing authentication and other security controls. This flaw affects all currently supported versions of ASP.NET Core, including versions 8, 9, and 10, as well as the older ASP.NET Core 2.3 running on the Windows-only .NET Framework. According to Microsoft’s security advisory, the vulnerability allows authenticated attackers to exploit inconsistent HTTP request interpretation, leading to the bypass of security features over a network. Security program manager Barry Dorrans explained that a successful attack could allow an adversary to log in as a different user, circumvent cross-site request forgery (CSRF) protections, or perform injection attacks. The actual risk posed by this vulnerability is highly dependent on the specific application code and deployment configuration, with the most severe outcomes occurring in applications that do not properly validate or handle HTTP requests. Dorrans emphasized that while the vulnerability is serious, the likelihood of exploitation is reduced if applications are well-designed and if reverse proxies or gateways are used to filter out smuggled requests. The high CVSS score reflects the potential for a security feature bypass that changes the scope of access, rather than the likelihood of exploitation in all environments. Developers have sought clarification on what constitutes vulnerable application code, but Microsoft has indicated that any application performing authentication or access control based on HTTP requests could be at risk if not properly secured. Kestrel is widely used as the default web server for ASP.NET Core applications, both behind reverse proxies and as a direct-facing server, increasing the potential exposure. Microsoft’s patch addresses the underlying issue in Kestrel, and organizations are urged to apply updates promptly to mitigate the risk. The vulnerability highlights the importance of secure coding practices and the need for defense-in-depth measures, such as using reverse proxies to sanitize incoming requests. Security teams should review their ASP.NET Core deployments, especially those directly exposing Kestrel to the internet, to ensure they are not susceptible to request smuggling attacks. The incident underscores the evolving complexity of web application security and the critical role of timely patch management. Microsoft’s response demonstrates a commitment to transparency and rapid remediation for high-severity vulnerabilities in its ecosystem. Organizations leveraging ASP.NET Core should remain vigilant for further advisories and best practice recommendations from Microsoft and the broader security community.
Jun 29, 2026