{"id":"CVE-2026-8398","published":"2026-05-15T09:16:17Z","modified":"2026-10-26T14:10:00Z","title":"Daemon Tools Lite Embedded Malicious Code Vulnerability","vendor":"Daemon","product":"Daemon Tools Lite","tier":"core","eol":null,"description":{"text":"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.","provenance":"source","from":"NVD"},"summary":{"text":"Daemon Tools Lite for Windows (versions 12.5.0.2421 through 12.5.0.2434) contains embedded malicious code, introduced through a supply chain compromise of the vendor's build or distribution infrastructure, in the DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe binaries. An attacker can exploit this over the network without authentication or user interaction, since the trojanized installers are distributed from daemon-tools.cc and signed with the legitimate AVB Disc Soft certificate, allowing them to pass as trustworthy and evade signature-based detection.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:11Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01456,"percentile":0.73466,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-27","dueDate":"2026-05-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://blog.daemon-tools.cc/post/security-incident ; https://nvd.nist.gov/vuln/detail/CVE-2026-8398","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-08","exploitedFirstSeen":"2026-05-08","ransomware":false,"evidence":[{"url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","date":"2026-05-08"},{"url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f","date":"2026-05-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-27"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"references":[{"url":"https://blog.daemon-tools.cc/post/security-incident","tags":["Vendor Advisory"]},{"url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398","tags":["US Government Resource"]}],"techniques":[{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Trojanized vendor installers via compromised supply chain","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A supply chain attack compromised the official installation packages","start":0,"end":68}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1553.002","name":"Code Signing","tactics":["defense-impairment"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Signed malicious binaries evade signature-based detection","mappingType":"primary_impact","evidence":[{"from":"description","quote":"These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate","start":451,"end":543}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-30514","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30514","exploited":true,"exploitedSince":"2026-05-27","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://securelist.com/tr/daemon-tools-backdoor/119654/"],"flow":[{"stage":"exploitation","techniques":["T1195.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1553.002"],"provenance":"ai"}],"timeline":[{"date":"2026-05-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/tr/daemon-tools-backdoor/119654/","provenance":"source"},{"date":"2026-05-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8398","provenance":"source"},{"date":"2026-05-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30514","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":12},"priority":{"score":69.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 176 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.69,"detail":"percentile 0.7347"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}