Japanese LMS Zero-Day Cobalt Strike Deployment (CVE-2026-5426) | MSSP Advisory

Risk Assessment

CVE-2026-5426 exposes a zero-day vulnerability in a Japanese Learning Management System where hard-coded ASP.NET machine keys enable attackers to deploy Cobalt Strike beacons. The hard-coded keys allow threat actors to bypass authentication and execute arbitrary code on vulnerable LMS installations. Attackers are actively exploiting this flaw to establish persistent access and move laterally through connected networks.

Your clients running any web applications with hard-coded machine keys face the same attack vector, and you need to audit their ASP.NET configurations immediately. If client networks get compromised through similar vulnerabilities while you knew about this attack pattern, that becomes a contract and retention problem.