Federal agency gives agencies three days to patch or remove software with embedded malicious code vulnerability.
- CISA added CVE-2026-8398 affecting Daemon Tools Lite to the Known Exploited Vulnerabilities catalog
- The vulnerability involves embedded malicious code with high impact on confidentiality, integrity and availability
- Federal agencies must apply mitigations or discontinue use by 30 May 2026
The US Cybersecurity and Infrastructure Security Agency has added a vulnerability in Daemon Tools Lite to its Known Exploited Vulnerabilities catalog, requiring federal agencies to take action within three days.
CVE-2026-8398 affects Daemon Tools Lite, a disc imaging software, and involves embedded malicious code that poses a high risk to system confidentiality, integrity and availability.
CISA’s catalog entry provides limited technical details about the vulnerability itself, describing it only as an “unspecified vulnerability” with embedded malicious code. The agency’s brief description suggests the vulnerability could allow attackers to compromise systems running the affected software.
Federal agencies must apply vendor-provided mitigations, follow applicable guidance from Binding Operational Directive 22-01 for cloud services, or stop using the product entirely if no mitigations are available. The remediation deadline is 30 May 2026.
Daemon Tools has published information about the security incident on its company blog, though CISA’s entry does not elaborate on the vendor’s response or available patches.
The vulnerability has also been catalogued in the National Vulnerability Database, which may contain additional technical details about the flaw.
CISA’s KEV catalog focuses on vulnerabilities known to be actively exploited in the wild. The agency’s decision to include CVE-2026-8398 suggests threat actors are already using this vulnerability in attacks against organisations running Daemon Tools Lite.
Why It Matters
This addition to CISA’s KEV catalog signals active exploitation of Daemon Tools Lite in real-world attacks. CISOs should immediately audit their environments for this software and prepare board reports on remediation timelines if the software is present. The three-day federal deadline reflects the severity and active nature of the threat.
What To Do Now
- Scan all systems for Daemon Tools Lite installations and document current versions
- Check Daemon Tools’ security incident blog post for available patches or mitigations
- Review CVE-2026-8398 in the National Vulnerability Database for additional technical details
- Remove the software from critical systems if no adequate mitigations are available
