Skip to main content
CVE-2026-80428VulnerabilityPublished 09/11/2026

CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE

Source Exploit-DB RSS Feed

0
Authoritative record:CVE-2026-80428· Critical 9.3

Not known to be exploited · public exploit available (Exploit-DB) · CVSS 9.3 Critical.

Data as of 10/25/2026, 09:04:02 UTC

CVSS base score
9.3Critical
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
4.6% chance of exploitation in 30 days – higher than 91% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Public exploits
1 Exploit-DB entryPublic attack or detection tooling exists; see Public exploits below.
Affects
ILIAS software prior to 9.22

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

  1. Disclosed: evidence found.

    CVE published 26 Aug 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: evidence found.

    Public exploit code: Exploit-DB ×1, first 11 Sep 2026

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

Timeline

  1. −5h

    CVE ID reserved

    by VulnCheck

  2. T0

    CVE published

    cve.org · t = 0

  3. +8m

    In Threat Radar

    record ingested

  4. +16d

    First Exploit-DB entry (opens in a new tab)

    CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

What to do

Affected software

ProductAffectedFixed in
Packagistilias/iliaspkg:composer/ilias/iliasOther threatsAffected
  • <9.22
  • >=9.0.0 <9.22
  • >10.0 <10.10
  • >11.0 <11.3
Fixed in
  • 9.22
  • 10.10
  • 11.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until a fix is available, restrict access to the affected ILIAS versions and monitor for suspicious activity related to Shibboleth integration.

Public exploits and detection

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

Description

CVE-2026-80428 is a critical unauthenticated PHP Object Injection vulnerability in ILIAS software versions prior to 9.22, between 10.0 and 10.10, and between 11.0 and 11.3. The flaw involves the Shibboleth integration and allows remote code execution (RCE) without authentication.

Impact

Successful exploitation of this vulnerability enables an unauthenticated attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or disruption of services. Given the unauthenticated access requirement, the risk is elevated.

Indicators of compromise

Exploit source code

Exploit code for CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCEPHP · 6,554 characters
#!/usr/bin/env python3
#
# Exploit Title: ILIAS <= 9.21 / 10.9 / 11.2 - Unauthenticated PHP Object Injection (RCE)
# Date: 2026-08-31
# Exploit Author: DigiProSec
# Vendor Homepage: https://www.ilias.de
# Software Link: https://github.com/ILIAS-eLearning/ILIAS
# Version: ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 (fixed in 9.22 / 10.10 / 11.3)
# Tested on: Rocky Linux 9, Apache + PHP-FPM 8.2, ILIAS 10.9 (MariaDB 10.11 backend)
# CVE: CVE-2026-80428
#
# CVE-2026-80428 — Unauthenticated PHP Object In…

References

Community reviews

Loading reviews…