External risk intelligence

Koollab LMS SQL Injection and Unsafe Deserialization Leading to Webshell and Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-63234

The vulnerability exists in a Learning Management System (LMS), which is typically deployed as an internet-facing web application. Since the attack occurs via a web endpoint accessible to authenticated users, it is commonly exposed to the internet in educational and corporate environments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Koollab Learning Management System that could allow an authenticated user to execute arbitrary code on the server. This issue stems from how the system handles certain data inputs, potentially enabling an attacker to gain control of the server's operations. The primary concern is to determine if our organization uses this specific system and if it is exposed externally.

Flaw allows code execution on the server.
Relevant if we use Koollab LMS externally.
Confirm exposure; assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker with existing user credentials could exploit this vulnerability by sending specially crafted input to the manual mark assessment endpoint. This input would trigger both a SQL injection and an unsafe deserialization flaw, ultimately allowing the attacker to write a web shell to a publicly accessible directory. With this web shell, an attacker could then execute arbitrary code on the server, potentially leading to a full system compromise.

Authenticated access is required.
Input sent to assessment endpoint triggers vulnerability.
Allows arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could inject malicious SQL code and exploit an unsafe deserialization vulnerability within the Koollab LMS to gain server-side code execution. This could occur through the manual mark assessment endpoint when supported by the advisory's conditions.

Server-side code execution.
Injection via the manual mark assessment endpoint.
Arbitrary code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection and unsafe deserialization vulnerability in Koollab LMS requires immediate attention from the platform or infrastructure team managing the Learning Management System. The first practical step is to identify all instances of Koollab LMS within the environment, confirm their reachability and business criticality, and identify the accountable owner. Subsequently, a risk-based remediation plan should be developed, which may involve patching, configuration changes, or implementing compensating controls.

Platform/Infrastructure team ownership.
Verify Koollab LMS instances and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Koollab LMS?

Koollab LMS is a software platform designed for learning management, commonly used in educational or corporate environments to host courses and track student assessments. It functions as a web-based application that manages user interactions, grade books, and instructional content on a server.

What does SQL injection and unsafe deserialization mean for CVE-2026-63234?

These are two distinct security weaknesses. SQL injection allows an attacker to manipulate the database by injecting malicious queries. Unsafe deserialization happens when the system processes untrusted data without proper validation, which can allow an attacker to alter the logic of the application. In this CVE, these flaws work together to let an attacker write malicious files to the server and execute unauthorized code.

How is this vulnerability triggered?

The attack begins at the manual mark assessment endpoint. An attacker must have existing, legitimate user credentials to access this specific part of the system. Sending specially crafted input to this endpoint initiates the attack. It is important to note that actions performed by unauthenticated users or interactions with non-assessment endpoints do not trigger this specific vulnerability.

Is my organization at risk from CVE-2026-63234?

Risk depends on your deployment. Halo Surface Signal notes that since Koollab LMS is typically an internet-facing web application, instances accessible from the public internet are at higher risk. If your instance is reachable by authenticated users over the web, the potential for exploitation exists. Internal-only systems may face lower risk but should still be evaluated.

What should I do if I run Koollab LMS?

Begin by auditing your infrastructure to locate all instances of Koollab LMS. Once identified, determine if these instances are accessible over the internet or restricted to internal networks. Assign ownership to the appropriate technical team and assess the business impact to prioritize a remediation plan, which may include applying vendor-provided patches or implementing temporary configuration changes.

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.