cyfenced.com →

[ CVE-2026-8398 · Published 15 May 2026 ]

Daemon Tools Lite Embedded Malicious Code Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-05-27
  • Critical severity: CVSS 9.8

[ Description ]Official description

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

CISA: Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 30 May 2026): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References