ILIAS PHP Object Injection Vulnerability Enables Unauthenticated RCE

• •CVE-2026-80428 allows unauthenticated RCE in ILIAS due to PHP object injection.
• •Affected versions include ILIAS 9.22, 10.0-10.9, and 11.0-11.2; patches are available.
• •Exploitation requires only two POST requests, posing a severe risk to server integrity.

A critical vulnerability (CVE-2026-80428) in ILIAS allows unauthenticated remote code execution via PHP object injection. Discovered by DigiProSec, the flaw affects ILIAS versions prior to 9.22, 10.0 through 10.9, and 11.0 through 11.2. The attack exploits two unauthenticated endpoints, ltiauth.php and shib_logout.php, enabling an attacker to execute arbitrary PHP code on the server. The exploit requires only two POST requests and can be executed without authentication. A working proof-of-concept (PoC) was published on September 3, 2026. The vulnerability has been confirmed to allow execution as the web server user, which poses a significant risk to sensitive data and lateral movement within networks. ILIAS has released patches in versions 9.22, 10.10, and 11.3. Security professionals are urged to apply these updates immediately.