Unauthenticated PHP Object Injection in ILIAS by ILIAS eLearning
CVE-2026-80428

9.3CRITICAL

Key Information:

Vendor: Ilias-elearning E.v.
Status: Ilias
Vendor: CVE Published:; 26 August 2026

🔔 Create Ilias-elearning E.v. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-80428?

The vulnerability in ILIAS allows an unauthenticated attacker to exploit the Shibboleth logout endpoint, enabling the daserialization of session data. This endpoint lacks proper authentication controls, allowing attackers to craft serialized object data that could lead to arbitrary PHP code execution. By leveraging this vulnerability, an attacker can manipulate session data stored in the database and invoke object destructors which execute code in the context of the web server user. The flaw has been addressed in ILIAS versions 9.22, 10.10, and 11.3, which removed the insecure logout-notification handler.

Affected Version(s)

ILIAS 9.0 < 9.22

ILIAS 10.0 < 10.10

ILIAS 11.0 < 11.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-80428 - Proof of Concept