Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
IncidentKnowledgeDeliverunknown threat actorASP.NET Read at Mandiant
Below is the opening; the full story is at Mandiant.
From Mandiant
Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek
Introduction
In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver. KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (RCE). An unknown threat actor leveraged this access to inject malicious code into the LMS platform, with the goal of infecting users visiting the site.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.