[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
Public exploit released for CVE-2026-80428, unauthenticated PHP object injection via Shibboleth in ILIAS LMS, enabling remote code execution.
Exploit-DB entry 52682 publishes a proof-of-concept for CVE-2026-80428, an unauthenticated PHP object injection flaw in the ILIAS learning management system. The vulnerability is reachable through the Shibboleth authentication integration and can result in remote code execution. Affected versions are ILIAS below 9.22, 10.x below 10.10, and 11.x below 11.3. No evidence of in-the-wild exploitation is stated in the disclosure.
- Unauthenticated PHP object injection via the Shibboleth integration enables remote code execution in ILIAS.
- Affected versions: ILIAS below 9.22, 10.x below 10.10, and 11.x below 11.3.
- Proof-of-concept exploit published on Exploit-DB as entry 52682.
- CVEs
- CVE-2026-80428
- Vendors
- ILIAS
- Products
- ILIASShibboleth
- Organizations
- Exploit-DB
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80428 | Unauthenticated PHP Object Injection RCE in ILIAS < 9.22, 10.10, 11.3 | 9.3 | 5% | PoC |
From the original article
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9. 22, 10. 0 < 10.
exploit-db.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.