External risk intelligence

Unauthenticated PHP Object Injection via ILIAS Shibboleth Logout Endpoint.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-80428

The vulnerability resides in a public-facing web application endpoint (Shibboleth back-channel and LTI authentication entry point) designed to handle unauthenticated requests over the network. These components are standard parts of the application's external-facing identity and session management interface, making the vulnerable surface reachable by design from the public internet.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in ILIAS software allows unauthenticated attackers to execute code as the web server user by exploiting a flaw in how session data is handled through the Shibboleth logout endpoint. This issue arises because the system deserializes stored session data without proper restrictions, enabling the instantiation of potentially malicious objects. This can lead to attacker-controlled content being placed at attacker-chosen paths below the web root, ultimately resulting in code execution.

Unauthenticated attackers can execute code.
It impacts web server access and control.
Verify if your ILIAS system is affected.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can gain code execution by sending a specially crafted request to an exposed endpoint. This endpoint is designed to handle unauthenticated requests, allowing an attacker to place malicious data into session storage. Later, a different unauthenticated endpoint processes this stored data, leading to the instantiation of arbitrary objects and ultimately code execution as the web server user.

No authentication is required.
Triggered by unauthenticated session processing.
Leads to web server code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could achieve code execution on the web server by sending a crafted request to the Shibboleth back-channel endpoint. This occurs when a serialized object, placed into a session by the LTI authentication entry point, is deserialized without proper restrictions. The vulnerability is present when the application is reachable and the specific vulnerable endpoint is exposed.

Attacker-controlled content at web root.
Unauthenticated deserialization of session data.
Code execution as web server user.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ILIAS, stemming from unauthenticated deserialization of session data via the Shibboleth back-channel endpoint, requires immediate attention from teams managing the ILIAS application and its underlying infrastructure. The first practical step is to identify all instances of the affected ILIAS deployment, confirm their exposure and criticality, and then ascertain the accountable owner for remediation. Planning should then focus on risk-based mitigation, potentially involving vendor coordination.

Who owns this: Application owners and infrastructure teams.
Verify first: Identify and confirm affected instances.
Action: Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ILIAS and why does it have these authentication components?

ILIAS is a web-based learning management system used for hosting courses, managing exams, and tracking learner progress. To support large institutions, it includes identity management features like Shibboleth for single sign-on and LTI for integrating external learning tools. These components act as bridges between the platform and other services, which necessitates having endpoints that can process identity-related data from external systems.

What does CVE-2026-80428 mean by insecure deserialization?

This vulnerability, classified as CWE-502, occurs when the software takes saved session data and transforms it back into active program objects without checking if the data is trustworthy. By tricking the application into recreating specific objects, an attacker can manipulate the program's behavior. In this case, the flaw allows the attacker to influence file operations, ultimately leading to unauthorized code execution on the server.

How does an attacker trigger this vulnerability?

An attacker triggers this by first sending a crafted request to the LTI entry point, which stores malicious data into a session row without requiring a login. They then target the Shibboleth logout endpoint. This endpoint improperly processes every active session row by deserializing the stored data. Simply having an active session row is the prerequisite; the bug is not triggered by standard user activity that lacks these specifically prepared serialized objects.

Is my ILIAS instance at risk?

According to Halo Surface Signal, this risk is very likely for most installations because the vulnerable endpoints are designed to be public-facing. Since these components handle identity and session management, they are exposed to the internet by default to facilitate remote authentication. If your server is reachable from the public internet, you should assume the vulnerable surface is accessible to anyone.

What are the first steps to address this CVE?

Begin by auditing your environment to locate every running instance of ILIAS. Once you have a complete inventory, verify the installed version against the secure releases provided by the vendor. Prioritize updating these systems to version 9.22, 10.10, 11.3, or later, as these versions completely remove the vulnerable code path. If immediate patching is not possible, coordinate with your infrastructure team to restrict access to the affected endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.