CVE-2026-8398Active Exploitation(disc-soft / daemon_tools)

HIGHCVSS 9.3 · CRITICALCISA KEV

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

Patch disc-soft daemon_tools systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

disc-soft CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-05-30. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://securelist.com/tr/daemon-tools-backdoor/119654/

Vendor / third-party advisories

https://blog.daemon-tools.cc/post/security-incident

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398

Weakness type (CWE)

CWE-506

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

daemon_tools
windows

Threat summary

Active exploitation appears in 14 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
22 mentions across 9 observed days

What's happening

Active exploitation reported across 14 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 7 signals
Technical details provided in 5 signals
General: 5 classified signals
Disclosure: 3 classified signals
Peaked 7d ago at 8 mentions (2026-05-28); latest day: 1
22 total mentions across 9 days

Affected systems

Vendors

disc-soft microsoft

Products

daemon_toolswindows

2 versions affected across 2 products

Deep dive

Activity timeline22 mentions / 9d

Signal classification4 categories

Active Exploitation

1150.0%

General

522.7%

Disclosure

313.6%

Patch

313.6%

Referenced assets21 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-27	2	General2
2026-05-28	8	Active Exploitation5Disclosure2Patch1
2026-05-29	2	Active Exploitation2
2026-05-30	2	Disclosure1General1
2026-05-31	1	Active Exploitation1
2026-06-01	3	General2Patch1
2026-06-02	1	Active Exploitation1
2026-06-11	2	Active Exploitation2
2026-06-17	1	Patch1

Full discourse20 posts

CISA Cyber@CISACyber137d
General
🛡️ We added Daemon Tools Lite embedded malicious code vulnerability CVE-2026-8398, TanStack vulnerability CVE-2026-45321 & Nx Console vulnerability CVE-2026-48027 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/Sk7r1825lX
Post summary
The tweet announces that three CVEs have been added to the DHS KEV Catalog, but it offers no additional information on PoCs, exploitation, patches, or technical specifics.
32114977.5K
300.1K followersView on X
piyokango@piyokango137d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（5/27追加） 🛡No.1605 CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability =================================== ✅概要・深刻度：緊急 9.8 (CVSS Base) / NVD ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Nx Console 18.95.0 の悪意あるバージョンが一次公開されていた脆弱性。2026年5月19日 12:30 UTC に Visual Studio Marketplace へ公開され、12:48 UTC に削除されるまで約18分間利用可能となっていたもの。さらにOpenVSX では 12:33 UTC から 13:09 UTC まで約36分間、侵害されたバージョンが利用可能となっていたもの。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：低 ✅攻撃前提条件・Nx Console 18.95.0 が Visual Studio Marketplace または OpenVSX からインストールされる・VS Code またはその派生環境で拡張機能が有効化される・対象端末に GitHub、npm、AWS、Vault、1Password、SSH 鍵などの認証情報が存在する ✅悪用時影響・認証情報の窃取・永続化アーティファクトの作成・外部へのデータ送信・侵害された認証情報を利用した追加のリポジトリ操作やサプライチェーン侵害 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-48027 ・https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ・https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise ・https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised 🛡No.1606 CVE-2026-45321 TanStack Unspecified Vulnerability =================================== ✅概要・深刻度：緊急 9.6 (CVSS Base) / GitHub, Inc. (CNA) ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H 2026年5月11日 19:20 から 19:26 UTC 頃に、42件の @ tanstack/* パッケージにわたり 84件の悪意あるバージョンが npm レジストリへ公開されていたもの。公開は TanStack/router 向けの正規 GitHub Actions OIDC trusted-publisher binding により認証されていたが、公開ワークフロー自体は変更されていなかった。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：中 ✅攻撃前提条件・影響を受けた @ tanstack/* パッケージの悪意あるバージョンを npm、pnpm、yarn などでインストールする・インストール処理により悪意ある payload が実行される・対象環境にクラウド認証情報、GitHub トークン、SSH 鍵などが存在する ✅悪用時影響・クラウド認証情報、GitHub トークン、SSH 鍵などの窃取・窃取情報の外部送信・被害者が管理する npm パッケージへの同様の注入・サプライチェーン侵害の拡大 ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（TanStack / GitHub, Inc.） 42件の @ tanstack/* パッケージに 84件の悪意あるバージョンが公開され、認証情報窃取マルウェアが正規の trusted-publisher 経路で配布されたと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-45321 ・https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ・https://tanstack.com/blog/npm-supply-chain-compromise-postmortem ・https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem 🛡No.1607 CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability ==================================== ✅概要・深刻度：緊急 9.3 (CVSS Base) / Kaspersky Labs (CNA) ・種別：埋め込まれた悪意のあるコード (CWE-506) ・CVSS:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N DAEMON Tools Lite の Windows 版 12.5.0.2421 から 12.5.0.2434 の公式インストールパッケージが侵害され、2026年4月8日頃から2026年5月5日頃まで正規サイト daemon-tools .cc から配布された。攻撃者は AVB Disc Soft のビルドまたは配布基盤に不正アクセスし、DTHelper.exe、DiscSoftBusServiceLite.exe、DTShellHlp.exe をトロイの木馬化したもの。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：低 ✅攻撃前提条件・影響期間中に DAEMON Tools Lite の該当 Windows 版を公式サイトからダウンロードまたはインストールしている・トロイの木馬化されたバイナリが起動される・対象は DAEMON Tools Lite 12.5.0.2421 から 12.5.0.2434 である ✅悪用時影響・端末情報の収集・追加ペイロードのダウンロードおよび実行・バックドアによる不正操作・機密情報の漏えい ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Kaspersky） Kaspersky LabsはDAEMON Tools Lite の公式インストールパッケージがサプライチェーン攻撃により侵害され、正規署名付きのトロイの木馬化バイナリが配布されたと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-8398 ・https://blog.daemon-tools.cc/post/security-incident ・https://securelist.com/tr/daemon-tools-backdoor/119654/ https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
CISA added three CVEs to the KEV catalog, confirming in-the-wild exploitation; PoC details were partially released, technical information is fully disclosed, but no functional exploit or patch was provided.
030524.9K
43.9K followersView on X
CCB Alert@CCBalert137d
Disclosure
Warning: #CISA added new vulnerabilities to its KEV list: CVE-2026-48027 in #Nx Console, CVE-2026-8398 in #Daemon Tools Lite and CVE-2026-45321 in #Tanstack. Make sure you are running the non-malicious version of the packages to avoid a supply chain attack. #Patch #Patch #Patch
Post summary
CISA has added three new CVEs to its KEV list and warns users to use non‑malicious package versions to avoid supply‑chain attacks.
02011314
7.2K followersView on X
University of ZERO@zerotalktoai137d
General
CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-45321 TanStack Unspecified Vulnerability CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability
Post summary
The text merely enumerates three CVE identifiers with brief descriptors, offering no technical, exploit, or mitigation details.
00020152
1.6K followersView on X
Lyrie.ai@lyrie_ai123d
Active Exploitation
00:00 UTC: CVE-2026-8398 disclosed. CISA: CVE-2026-8398 added to Known Exploited Vulnerabilities — Daemon Daemon Tools Lite Status: ✅ Confirmed exploited in the wild Date added: 2026-05-27 Required action: Apply mitigations per vendor instructions, follow applicable BOD…
Post summary
CVE-2026-8398 is confirmed to be exploited in the wild, with vendors advised to apply mitigations.
1000054
266 followersView on X
Orizon@OrizonCyber135d
Active Exploitation
🚨 CVE-2026-8398 hits CISA KEV Daemon Tools Lite = actively exploited in the wild If you're running this, assume breach until patched. Why do "lite" apps always carry heavyweight risks? #infosec #CVE
Post summary
CVE-2026-8398 is recognized by CISA as actively exploited; users of Daemon Tools Lite should treat their systems as breached until a patch becomes available.
10000119
43 followersView on X
Atarus@Atarussecurity136d
Active Exploitation
CISA added three actively exploited supply chain vulnerabilities to the KEV catalog this week. CVE-2026-8398 affects Daemon Tools Lite, where attackers shipped trojanized signed installers from the vendor's own website for nearly a month. CVE-2026-45321 affects TanStack, where 42 npm packages were compromised via GitHub Actions trusted-publisher abuse, cache poisoning, pull_request_target misconfiguration, and OIDC token theft from runner memory. CVE-2026-48027 affects Nx Console v18.95.0, the same VS Code extension that gave attackers access to GitHub's internal repositories last week. The exposure windows tell the story. Nx Console was live for 36 minutes. TanStack was live for 6 minutes. Daemon Tools was live for 27 days. Three layers of the developer-tooling stack, three different defender visibility levels, all confirmed exploited. Then on May 28, CISA issued a separate formal alert about Megalodon, a campaign injecting malicious GitHub Actions workflows into public repositories. The attack moves further upstream into the automation layer that decides what becomes trusted. Federal remediation deadline is June 17, accelerated to May 30 for Daemon Tools. Verizon DBIR put commercial median time-to-patch at 43 days. The gap between federal and commercial response is where breaches happen. The methodology Atarus has been tracking for six weeks is now the federal patching priority. Full analysis from Atarus Research: https://www.atarussecurity.com/post/cisa-added-three-supply-chain-cves-to-kev-including-the-nx-console-that-compromised-github-the-meth
Post summary
CISA has identified three supply‑chain CVEs that are actively exploited, detailing exploitation methods, brief exposure windows, and federal remediation deadlines.
0000181
19 followersView on X
SHORT INFO@ShortInfoNews117d
Patch
Anyone who installed DAEMON Tools Lite on Windows between April 8 and May 5 may now have a backdoor running at every boot. Three signed components were trojanized in a supply chain attack with Chinese-language artifacts. Fix: v12.6. CISA added CVE-2026-8398 to KEV May 27.
Post summary
Supply chain attack on DAEMON Tools Lite introduced a boot‑time backdoor (CVE‑2026‑8398); CISA has added it to KEV for active exploitation, and a patch to v12.6 is available.
0000057
155 followersView on X
Lyrie.ai@lyrie_ai123d
Active Exploitation
https://lyrie.ai/research/research/active-exploit-cve-2026-8398-daemon-tools-lite #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post links to a research page about an active exploitation of CVE-2026-8398 in Daemon Tools Lite, suggesting the presence of a PoC but no patch or technical details are disclosed.
0000030
266 followersView on X
White Rabbitx 🏴‍☠️@TheRabbitPy132d
Active Exploitation
Daemon Tools Lite Embedded Malicious Code Vulnerability CISA just added CVE-2026-8398 to the kev catalog meaning it is not theoretical it is being exploited in the wild right now so when was the last time you checked your software supply chain for signed binaries that turned malicious #infosec #cve #supplychain #blueteam https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog
Post summary
CISA has added CVE-2026-8398 to its KEV catalog, confirming that the vulnerability is actively exploited in the wild.
0000096
1.3K followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker133d
General
【脆弱性情報】 CVE-2026-8398 AVB Disc SoftのDAEMON Tools Liteの脆弱性について https://www.cybernote.click/2026/05/29/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-8398-avb-disc-soft%e3%81%aedaemon-tools-lite%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6/ #IT #Security #cybersecurity
Post summary
A brief vulnerability announcement for CVE-2026-8398 in DAEMON Tools Lite is shared via a link, with no additional technical details, PoC, exploit code, or mitigation information provided.
0000047
211 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker133d
General
【脆弱性情報】 CVE-2026-8398 AVB Disc SoftのDAEMON Tools Liteの脆弱性について https://www.cybernote.click/2026/05/29/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-8398-avb-disc-soft%e3%81%aedaemon-tools-lite%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6-2/ #IT #Security #cybersecurity
Post summary
The post links to a vulnerability report on CVE-2026-8398 regarding DAEMON Tools Lite but provides no technical details, PoC, exploit, patch, or evidence of active exploitation.
0000050
211 followersView on X
عبدالعزيز الزامل@azez_alzamil133d
Patch
⚠️ هجوم سلسلة توريد عبر DAEMON Tools Lite (CVE-2026-8398) — أضافته CISA لقائمة KEV. حُقنت برمجيات خبيثة في ملفات موقّعة بشهادات Code-Signing شرعية ووُزّعت من الموقع الرسمي (أبريل–مايو 2026). حدّث إلى 11.2.1 أو أزل البرنامج. #CyberSecurity #SupplyChain المصدر: SecurityAffairs
Post summary
CISA added CVE‑2026‑8398 to its KEV list after confirming malicious software signed with legitimate certificates was distributed via the official DAEMON Tools Lite site; users are advised to update to version 11.2.1 or uninstall the software.
0000067
209 followersView on X
Nicolas Coolman@NicolasCoolman134d
Active Exploitation
🚨 DAEMON Tools Lite : La CISA alerte sur la faille critique CVE-2026-8398 activement exploitée. #zoneantimalware https://t.co/Mi42yb2Wf0
Post summary
CISA warns that CVE-2026-8398 is being actively exploited; no PoC, patch, or technical details are provided.
0000063
87 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker134d
Disclosure
【脆弱性情報】 CVE-2026-8398 AVB Disc SoftのDAEMON Tools Liteの脆弱性について https://www.cybernote.click/2026/05/29/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-8398-avb-disc-soft%e3%81%aedaemon-tools-lite%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6-2/ #IT #Security #cybersecurity
Post summary
The article announces CVE-2026-8398, a vulnerability affecting AVB Disc Soft's DAEMON Tools Lite, but it does not provide technical details, proof of concept, or exploit information.
0000061
209 followersView on X
IntegSec@integ_sec135d
General
CVE-2026-8398: DAEMON Tools Lite Supply Chain Attack - What It Means for Your Business and How to Respond https://hubs.li/Q04jtdT30
Post summary
The snippet references CVE-2026-8398 tied to a supply chain attack involving DAEMON Tools Lite but offers no concrete details, exploit code, patch information, or evidence of active exploitation.
0000060
32 followersView on X
RedLegg@RedLegg136d
Active Exploitation
Security Bulletin: DAEMON Tools Lite (CVE-2026-8398, CVSS 9.8) was impacted by a malicious supply-chain compromise. Exploited in the wild — act now. #ThreatIntel #RedLeggCTI https://hubs.li/Q04jfy8D0
Post summary
DAEMON Tools Lite CVE-2026-8398, rated CVSS 9.8, has been actively exploited through a supply‑chain attack, with no PoC or patch referenced in the bulletin.
00000106
2.2K followersView on X
NerdieNews@NewsNerdie137d
Active Exploitation
🚨 BREAKING: CISA updates its Known Exploited Vulnerabilities Catalog with three new entries, including CVE-2026-8398 and CVE-2026-45321, due to active exploitation evidence. Stay vigilant and update systems promptly. #NerdieNews #CyberSecurity #BreakingNews #InfoSec https://t.co/7HIJJCGNrT
Post summary
CISA has added CVE-2026-8398 and CVE-2026-45321 to its Known Exploited Vulnerabilities Catalog because of confirmed active exploitation, urging prompt system updates.
0000052
64 followersView on X
ByteSec1401 Efshagari@Leila97726926137d
Active Exploitation
Three CVEs have been added to the list of known exploits; CVE-2026-45321 (TanStack), CVE-2026-48027 (Nx Console) and CVE-2026-8398 (DAEMON Tools Lite). The trio has been linked to an attack campaign named "Mini Shai-Hulud" and has been attributed to cybercriminal group 'TeamPCP'. The campaign targeted Github, where the vulnerabilities enabled attackers to maneuver in CI/CD pipelines to extract proprietary source code depots. This would then cause supply chain issues to millions of end users. #TeamPCP #Github #cybercriminal https://ayinedjimi-consultants.fr/cve/mini-shai-hulud-supply-chain-npm-github-kev
Post summary
An active exploitation campaign, "Mini Shai-Hulud", leverages CVE-2026-45321, CVE-2026-48027, and CVE-2026-8398 to compromise GitHub CI/CD pipelines and exfiltrate proprietary source code, impacting millions of end users.
00000102
320 followersView on X
Hephaestvs@Vulcanux_137d
Active Exploitation
csirt_it: ‼️#DAEMONTools: rilevato sfruttamento della CVE-2026-8398 Rischio: 🔴 Tipologia 🔸Remote Code Execution 🔗https://acn.gov.it/portale/w/daemon-tools-lite-rilevato-sfruttamento-della-cve-2026-8398 ⚠ Importante aggiornare il prodotto interessato https://t.co/jlvaVQc2br
Post summary
The post reports that CVE-2026-8398 is actively being exploited for Remote Code Execution and advises users to update the affected product.
0000042
614 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	disc-soft	daemon_tools	12.5.1	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard disc-soft CVEs microsoft CVEs daemon_tools vulnerabilities

What researchers are saying

CVE-2026-8398

piyokango[verified]@piyokangoActive Exploitation

CISA added three CVEs to the KEV catalog, confirming in-the-wild exploitation; PoC details were partially released, technical information is fully disclosed, but no functional exploit or patch was provided.

University of ZERO[verified]@zerotalktoaiGeneral

The text merely enumerates three CVE identifiers with brief descriptors, offering no technical, exploit, or mitigation details.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

CVE-2026-8398 is confirmed to be exploited in the wild, with vendors advised to apply mitigations.

Orizon[verified]@OrizonCyberActive Exploitation

CVE-2026-8398 is recognized by CISA as actively exploited; users of Daemon Tools Lite should treat their systems as breached until a patch becomes available.

Atarus[verified]@AtarussecurityActive Exploitation

CISA has identified three supply‑chain CVEs that are actively exploited, detailing exploitation methods, brief exposure windows, and federal remediation deadlines.

SHORT INFO[verified]@ShortInfoNewsPatch

Supply chain attack on DAEMON Tools Lite introduced a boot‑time backdoor (CVE‑2026‑8398); CISA has added it to KEV for active exploitation, and a patch to v12.6 is available.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

The post links to a research page about an active exploitation of CVE-2026-8398 in Daemon Tools Lite, suggesting the presence of a PoC but no patch or technical details are disclosed.

White Rabbitx 🏴‍☠️[verified]@TheRabbitPyActive Exploitation

CISA has added CVE-2026-8398 to its KEV catalog, confirming that the vulnerability is actively exploited in the wild.