BLACKOUT MAP

Daemon · Daemon Tools Lite

CVE-2026-8398

Daemon Tools Lite Embedded Malicious Code Vulnerability

Exploited in attacks Critical 9.3 Attack chance: 1.5%
Share

What it is

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

CISA: Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: May 30, 2026

Added to the CISA list
May 27, 2026
Published
May 15, 2026
Severity
Critical 9.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS)
1.5% in the top 26.6% of all known vulnerabilities
Weakness
CWE-506
More details
NVD · CVE.org · CISA
All references (2)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.