CVE-2026-80428

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

September 13, 2026

Last Seen

September 14, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

ILIAS PHP Object Injection Vulnerability Enables Unauthenticated RCE72.0

A critical vulnerability (CVE-2026-80428) in ILIAS allows unauthenticated remote code execution via PHP object injection. Discovered by DigiProSec, the flaw affects ILIAS versions prior to 9.22, 10.0 through 10.9, and 11.0 through 11.2. The attack exploits two unauthenticated endpoints, ltiauth.php...