---
id: CVE-2026-80428
title: >-
  ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP
  object injection vulnerability that allows unauthenticated attackers to
  execute arbitrary code by injecting serialized objects through the LTI
  authentication end…
summary: >-
  ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP
  object injection vulnerability that allows unauthenticated attackers to
  execute arbitrary code by injecting serialized objects through the LTI
  authentication end…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
published: '2026-08-26'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:48:45.067'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80428'
references:
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225630&ref_id=35
    label: disclosure@vulncheck.com
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225631&ref_id=35
    label: disclosure@vulncheck.com
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&obj_id=225632&ref_id=35
    label: disclosure@vulncheck.com
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=934
    label: disclosure@vulncheck.com
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=935
    label: disclosure@vulncheck.com
  - url: >-
      https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=936
    label: disclosure@vulncheck.com
  - url: 'https://github.com/ILIAS-eLearning/ILIAS'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ILIAS-eLearning/ILIAS/commit/f36934a6f937d0fe837ca6e642986458b4069a95
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ilias-before-9.22-10.10-and-11.3-unauthenticated-php-object-injection-via-shibboleth-logout-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.02332
epssPercentile: 0.82822
exploits:
  exploitdb: true
  github: 2
  githubRepos:
    - 'https://github.com/digiprosec/CVE-2026-80428'
    - 'https://github.com/shivammittal2403/cve-2026-80428-ctf'
  checkedAt: '2026-09-24T07:53:18.794Z'
exploitAvailable: true
ingestedAt: '2026-08-29T21:42:34.669Z'
---

## Overview

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.