CVE-2026-80428

ILIAS, an open-source learning management system, is vulnerable to an unauthenticated PHP object injection flaw (CWE-502) exploitable through the combination of its LTI authentication and Shibboleth back-channel logout endpoints. An unauthenticated attacker first injects arbitrary serialized objects into session storage via the LTI authentication endpoint, then triggers unsafe deserialization of that data through the Shibboleth back-channel logout endpoint. By chaining an available POP (property-oriented programming) gadget, the attacker can write attacker-controlled PHP content to a web-accessible path, achieving remote code execution with the privileges of the web server user. All ILIAS deployments on affected versions — prior to 9.22 on the 9.x branch, prior to 10.10 on the 10.x branch, and prior to 11.3 on the 11.x branch — are affected, with exploitation requiring no credentials or user interaction (CVSS 4.0: 9.3). As of now there is no known public proof-of-concept, it is not listed in CISA KEV, and EPSS estimates only a 0.7% chance of exploitation within 30 days, so no in-the-wild exploitation is confirmed.

What to do: Upgrade ILIAS to 9.22, 10.10, or 11.3 or later, depending on your branch. Where patching is delayed, restrict network or web-server access to the LTI authentication and Shibboleth back-channel logout endpoints, and audit session storage and web-accessible directories for unexpected PHP files that would indicate prior exploitation.