$ cve CVE-2026-80428 JSON

CVE-2026-80428 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 4.5% (pctl 91)

Patch early

A public exploit exists.

Description

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	4.46% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	yes
Published	2026-08-26
Last modified	2026-09-10

Public exploits

Source	Title	Date
exploit-db	CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE	2026-09-11

References

→ the Explorer · watch your stack · NVD