Skip to content
Log inStart free trial

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…

Critical Known exploited
Severity
9.3 / 10
Critical · CVSS 4.0
Exploit chance (EPSS)
1.46%
Chance of exploitation in the next 30 days. Higher than 73.50% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since May 27, 2026
Weakness
CWE-506 Embedded Malicious Code
Fix
None yet
No fixed version published
Exploited in the wild. Daemon Tools Lite Embedded Malicious Code Vulnerability (Daemon Daemon Tools Lite). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by May 30, 2026.

Description

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-506: Embedded Malicious Code

The product contains code that appears to be malicious in nature.

How to prevent it
  • Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2026-48027
Compromised Nx Console version 18.95.0
Critical Known exploited Same weakness, CWE-506
GHSA-g7cv-rxg3-hmpx
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Critical Known exploited Same weakness, CWE-506
GHSA-5mg7-485q-xm76
Two LiteLLM versions published containing credential harvesting malware
Critical Same weakness, CWE-506
GHSA-69fq-xp46-6x23
Trivy ecosystem supply chain was briefly compromised
Critical Known exploited Same weakness, CWE-506
CVE-2025-59374
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…
Critical Known exploited Same weakness, CWE-506
GHSA-pxx3-g568-hxr4
color-convert@3.1.1 contains malware after npm account takeover
High Same weakness, CWE-506
GHSA-5fvm-p68v-5wmh
color-name@2.0.1 contains malware after npm account takeover
High Same weakness, CWE-506
GHSA-4x49-vf9v-38px
debug@4.4.2 contains malware after npm account takeover
High Same weakness, CWE-506
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor