---
id: "CVE-2026-8398"
kind: "vulnerability"
aliases: ["CVE-2026-8398"]
title: "disc-soft daemon tools: A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Daemon Daemon Tools Lite", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "disc-soft daemon tools", "fixed": [], "affected": "= 12.5.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["daemon-tools-lite", "exploited", "other", "windows"]
not_affected_if: ["does-not-run-daemon-tools-lite"]
published_at: "2026-05-15T09:16:17+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8398", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8398", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# disc-soft daemon tools: A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions…

Daemon Tools Lite contains embedded malicious code, according to its KEV entry, and CISA lists it as actively exploited. The sources describe high impact on confidentiality, integrity and availability, which suggests an attacker can read data, change it, or disrupt the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Daemon Daemon Tools Lite affected ? fixed ?
- vendor:disc-soft daemon tools affected = 12.5.1 fixed ?

## Fix

Apply the vendor mitigation per CISA guidance, or discontinue use of Daemon Tools Lite if no mitigation is available. The affected and fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8398
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8398

## From the sources

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_