CVE-2026-8398 in disc-soft daemon tools
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Affected software: disc-soft daemon tools
Scores
- CVSS: 9.3 (critical)
- EPSS: 1.46% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-05-27
- Published: 2026-05-15
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Remove the compromised Daemon Tools Lite build (CVE-2026-8398)
Patch or upgrade. A malicious build of Daemon Tools Lite was distributed. Removing it, installing the clean release named by the vendor and checking the host closes the risk.
Applies to: Daemon Tools Lite builds named in the vendor's security incident post.
- Find hosts with Daemon Tools Lite installed through your software inventory or EDR.
- Compare the installed version with the affected builds in the vendor's security incident post.
- Uninstall affected builds and install the clean release the vendor names, or remove the tool if not needed.
- Scan affected hosts with your EDR and rotate credentials used on them.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.