Unauthenticated PHP Object Injection (CVE‑2026‑80428) Enables Remote Code Execution in ILIAS LMS

Unauthenticated PHP Object Injection (CVE‑2026‑80428) Enables Remote Code Execution in ILIAS LMS

What It Is – A newly disclosed vulnerability (CVE‑2026‑80428) in ILIAS versions < 9.22, 10.0 < 10.10 and 11.0 < 11.3 allows an unauthenticated attacker to supply a crafted payload to the Shibboleth back‑channel logout endpoint. The payload is unserialized without a class allow‑list, leading to arbitrary PHP code execution as the web‑server user.

Exploitability – Public exploit code is available on Exploit‑DB (EDB‑ID 52682). The attack works remotely over HTTP with no authentication required. The CVSS score is not published, but the unauthenticated RCE vector places it in the Critical range.

Affected Products – ILIAS open‑source learning‑management system (versions < 9.22, 10.0 < 10.10, 11.0 < 11.3).

Why It Matters for Trust & Control Assurance

• Vulnerability Management – The flaw demonstrates the need for continuous scanning of third‑party components and rapid patch deployment to keep the control objective of “maintain a current, vetted software inventory” satisfied across multiple frameworks.
• Secure Configuration & Code Review – Unrestricted unserialize() calls break the control objective of “enforce secure coding practices and configuration hardening,” a single control that maps to NIST CSF Identify and Protect functions as well as ISO 27001 A.12.6.
• Evidence for Audits – Demonstrating that you have applied the vendor’s fix, updated your configuration, and captured remediation evidence feeds directly into a defensible audit trail that enterprise buyers increasingly demand.

Recommended Actions

1. Apply the vendor‑released patches (ILIAS 9.22, 10.10, 11.3) immediately.
2. If patching is delayed, block access to shib_logout.php at the perimeter and add a web‑application firewall rule to reject POST bodies that trigger the SoapServer.
3. Conduct a code‑review of all unserialize() calls and implement class allow‑lists or replace with safe deserialization libraries.
4. Update your vulnerability‑management tooling to flag this CVE and capture remediation evidence for audit purposes.
5. Map the remediation steps to the relevant control objective in your Trust Center to demonstrate continuous compliance.

Source: Exploit‑DB – CVE‑2026‑80428