CVE-2026-80428

Awaiting Analysis Awaiting Analysis - Queue

Deserialization Flaw in ILIAS Enables RCE via Shibboleth

Publication date: 2026-08-26

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-10

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80428

EUVD

EUVD-2026-66602

Affected Vendors & Products

Vendor	Product	Version / Range
ilias	ilias	to 10.10 (exc)
ilias	ilias	to 11.3 (exc)
ilias	ilias	11.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-80428 is an unauthenticated PHP Object Injection vulnerability in ILIAS versions before 9.22, 10.10, and 11.3. The Shibboleth logout endpoint deserializes session data without authentication checks. An attacker can exploit this by placing a malicious serialized object in a session row via the LTI authentication entry point, leading to arbitrary code execution when the object is instantiated and destroyed.

Detection Guidance

Check for the presence of the vulnerable Shibboleth logout endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php. Verify if the endpoint processes session data via unserialize without authentication restrictions. Inspect session handling for LTI authentication entry points storing request parameters in sessions.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the server as the web server user. It can lead to full system compromise, data theft, or unauthorized access to sensitive information. The attack requires no authentication and can be triggered by unauthenticated requests.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA compliance. It may result in data breaches, unauthorized disclosure of sensitive information, and failure to meet data protection requirements.

Mitigation Strategies

Upgrade ILIAS to versions 9.22, 10.10, or 11.3 or later to remove the vulnerable logout-notification implementation. Disable the Shibboleth logout endpoint if not required. Restrict access to the LTI authentication entry point and session handling mechanisms.

Hi! I’m here to help you understand CVE-2026-80428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70