CVE-2026-8398Daemon Tools Lite Embedded Malicious Code Vulnerability
Bekannt ausgenutzt — Daemon Tools Lite Embedded Malicious Code Vulnerability
CISA hat am 27.05.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 30.05.2026.
Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://blog.daemon-tools.cc/post/security-incident ; https://nvd.nist.gov/vuln/detail/CVE-2026-8398
Beschreibung
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| AVB Disc Soft | DAEMON Tools Lite | 12.5.0.2421 – < 2.6.0.* | |
| disc-soft | daemon tools | 12.5.1 |
Referenzen und Patches
- DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026 technical-descriptionthird-party-advisoryExploitThird Party Advisory
- Security Incident Affecting DAEMON Tools Lite: What We Know So Far vendor-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:disc-soft:daemon_tools:12.5.1:*:*:*:lite:*:*:*