CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: Daemon Tools Lite Embedded Malicious Code Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-506
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
AVB Disc Soft: DAEMON Tools Lite
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- blog.daemon-tools.cc/post/security-incident (opens in new tab)
- securelist.com/tr/daemon-tools-backdoor/119654/ (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)