CVE-2026-8398

● Known-exploited CRITICAL

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc...

Affects 0 products across 5 vendors.

CVSS 3.19.8
CVSS v49.3
EPSS1.0%
Percentile61th
PatchUnknown
Known-exploited since2026-05-27
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-506: CWE-506
Related Attack Patterns (CAPEC)
CAPEC-448 Embed Virus into DLL
via CWE-506
CAPEC-442 Infected Software
via CWE-506
CAPEC-636 Hiding Malicious Data or Code within Files
via CWE-506

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A supply chain attack compromised the official installation packages of DAEMON Tools Lite for Windows versions 12.5.0.2421 through 12.5.0.2434, leading to the distribution of trojanized binaries from the legitimate website daemon-tools.cc.

BSID: BS-2026-GLOBAL-269297-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-8398?
A supply chain attack compromised the official installation packages of DAEMON Tools Lite for Windows versions 12.5.0.2421 through 12.5.0.2434, leading to the distribution of trojanized binaries from the legitimate website daemon-tools.cc.
What is the CVSS score for CVE-2026-8398?
CVE-2026-8398 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.0%.
Is CVE-2026-8398 actively exploited?
Yes. CVE-2026-8398 is in the CISA known-exploited catalog (added 2026-05-27). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2026-8398?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-8398?
CVE-2026-8398 affects Daemon-Tools; Distribution; Lite; Three; Windows.
Vulnerability Details
CVE IDCVE-2026-8398
BSIDBS-2026-GLOBAL-269297-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2026-05-15
Last Modified2026-05-15
ICS Relevance0%
Weakness (CWE)
CWE-506
SourceNVD
Official Description

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and modified three binaries, including DTHelper.exe, to include malicious code.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Daemon-Tools — —
Distribution — —
Lite — —
Three — —
Windows — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 154 Days
CISA known-exploited● Active Exploitation Confirmed (added 2026-05-27)
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash77006d40428798133375dae7d9c100e2be2f39d2cc559167bdbfb4abe0c551c767d7d7ee332ffe9c1aa4b771fdef176f737d4a9a2077f9984cefbbce2dbcde26
Related CVEs affecting Daemon-Tools
CVE-2010-5239 6.9 Untrusted search path vulnerability in DAEMON Tools Lite 4.35.6.0091 and Pro ... CVE-2011-3987 4.9 dtsoftbus01.sys in DAEMON Tools Lite before 4.41.3, Pro Standard before 4.41....
View all Daemon-Tools CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2026-8398 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →