{"id":"CVE-2026-8398","kind":"vulnerability","aliases":["CVE-2026-8398"],"related":[],"title":"disc-soft daemon tools: A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions…","description":"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.","summary":"Daemon Tools Lite contains embedded malicious code, according to its KEV entry, and CISA lists it as actively exploited. The sources describe high impact on confidentiality, integrity and availability, which suggests an attacker can read data, change it, or disrupt the machine.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-05-27T00:00:00+00:00","products":[{"name":"Daemon Daemon Tools Lite","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"disc-soft daemon tools","fixed":[],"affected":"= 12.5.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["daemon-tools-lite","exploited","other","windows"],"not_affected_if":["does-not-run-daemon-tools-lite"],"how_to_check":null,"fix":"Apply the vendor mitigation per CISA guidance, or discontinue use of Daemon Tools Lite if no mitigation is available. The affected and fixed versions are not stated in the sources.","status":"open","published_at":"2026-05-15T09:16:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:01+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:34:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per CISA guidance, or discontinue use of Daemon Tools Lite if no mitigation is available. The affected and fixed versions are not stated in the sources.","summary":"Daemon Tools Lite contains embedded malicious code, according to its KEV entry, and CISA lists it as actively exploited. The sources describe high impact on confidentiality, integrity and availability, which suggests an attacker can read data, change it, or disrupt the machine.","category":"other","who_cares":["windows","daemon-tools-lite"],"confidence":0.6,"analyst_note":"Find the vendor advisory and the affected/fixed builds, and confirm what the embedded malicious code does; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8398.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["does-not-run-daemon-tools-lite"],"severity_if_unknown":"high"},"cost_usd":0.000387,"input_tokens":2065,"output_tokens":362,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A,25A '-8398':23A,26A '12.5.0.2421':100C '12.5.0.2434':102C '2026':113C,117C '5':116C '8':112C 'access':121C 'accord':50B 'activ':60B 'allow':156C 'appear':161C 'approxim':110C 'april':111C 'attack':9A,75B,88C,118C 'avail':71B 'avb':126C,149C 'base':167C 'binari':136C 'build':129C 'bypass':164C 'certif':155C 'chain':8A,87C 'chang':79B 'cisa':56B 'code':49B,153C 'code-sign':152C 'compromis':10A,89C 'confidenti':68B 'contain':46B 'cve':21A,24A 'daemon':4A,16A,27A,28A,34A,37B,43B,95C 'daemon-tools-lit':36B 'daemon-tools.cc':108C 'data':78B 'describ':64B 'detect':168C 'digit':144C 'disc':2A,32A,127C,150C 'disc-soft':1A,31A 'discsoftbusservicelite.exe':138C 'disrupt':82B 'distribut':103C,131C 'dthelper.exe':137C 'dtshellhlp.exe':140C 'embed':47B 'entri':54B 'exploit':40B,61B 'file':142C 'gain':119C 'high':65B 'impact':66B 'infrastructur':132C 'instal':13A,92C,159C 'integr':69B 'kev':53B 'legitim':106C,148C 'list':57B 'lite':18A,30A,39B,45B,97C 'machin':84B 'malici':48B,158C 'may':115C 'offici':12A,91C 'packag':14A,93C 'read':77B 'sign':145C,154C 'signatur':166C 'signature-bas':165C 'soft':3A,33A,128C,151C 'sourc':63B 'suggest':73B 'suppli':7A,86C 'three':135C 'tool':5A,17A,38B,44B,96C 'tools':29A,35A 'trojan':134C 'trustworthi':162C 'unauthor':120C 'vendor':124C 'version':20A,99C 'websit':107C 'window':19A,42B,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-15T09:16:17+00:00","kev":{"dateAdded":"2026-05-27","dueDate":"2026-05-30","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@kaspersky.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-8398","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8398","severity":null,"published_at":"2026-05-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-8398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8398","severity":null,"published_at":"2026-05-15T09:16:17+00:00","modified_at":"2026-06-17T11:03:53+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}