CVE-2026-80428: Deserialization of Untrusted Data in ILIAS-eLearning e.V. ILIAS
Description
ILIAS versions prior to 9.22, 10.10, and 11.3 contain an unauthenticated PHP object injection vulnerability. This flaw allows attackers to inject serialized objects through the LTI authentication endpoint and trigger deserialization via the Shibboleth back-channel logout endpoint. Exploitation can lead to remote code execution as the web server user by writing attacker-controlled PHP content to a web-accessible path.
CVSS v4.0
Score 9.3critical
Affected software
ILIAS-eLearning e.V.
ILIAS
pkg:github/ILIASRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-80428 is a critical unauthenticated PHP object injection vulnerability affecting ILIAS eLearning software versions before 9.22, 10.10, and 11.3. Attackers can inject serialized objects into session storage via the LTI authentication endpoint and exploit an available POP gadget during deserialization triggered by the Shibboleth back-channel logout endpoint. This unrestricted deserialization enables writing of attacker-controlled PHP code to a web-accessible location, resulting in remote code execution with the privileges of the web server user.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server as the web server user. This can lead to full compromise of the affected system, including data theft, service disruption, or further network penetration.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the LTI authentication and Shibboleth logout endpoints if possible and monitor for suspicious activity related to session storage manipulation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-26T10:43:44.175Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Indicators of Compromise
Exploit Source Code
Exploit code for CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
#!/usr/bin/env python3 # # Exploit Title: ILIAS <= 9.21 / 10.9 / 11.2 - Unauthenticated PHP Object Injection (RCE) # Date: 2026-08-31 # Exploit Author: DigiProSec # Vendor Homepage: https://www.ilias.de # Software Link: https://github.com/ILIAS-eLearning/ILIAS # Version: ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 (fixed in 9.22 / 10.10 / 11.3) # Tested on: Rocky Linux 9, Apache + PHP-FPM 8.2, ILIAS 10.9 (MariaDB 10.11 backend) # CVE: CVE-2026-80428 # # CVE-2026-80428 — Unauthenticated PHP Object In... (6054 more characters)
Threat ID: 6a8f0bdbacd9273b4917deda
Added to database: 08/26/2026, 15:52:59 UTC
Last enriched: 10/06/2026, 20:51:38 UTC
Last updated: 10/10/2026, 22:36:10 UTC
Views: 146
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.