Critical Severity
CVE-2026-80428
Published: Oct 25, 2026
ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)
<div align="center">
<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&size=32&duration=2800&pause=2000&color=00FF41¢er=true&vCenter=true&width=940&lines=CVE-2026-80428;ILIAS+Unauthenticated+PHP+Object+Injection;Remote+Code+Execution+%5BRCE%5D;Mass+Exploit+%2B+Interactive+Shell" alt="Typing SVG" />
<br>
<br>
<img src="https://user-images.githubusercontent.com/73097560/115834477-dbab4500-a447-11eb-908a-139a6edaec5c.gif" width="100%">
</div>
<br>
<div align="center">
## 🚨 **ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)**
### `CVE-2026-80428`
**Vector:** Shibboleth back-channel logout endpoint
**Impact:** Full Remote Code Execution as web server user
**Severity:** 🔴 **CRITICAL**
</div>
<br>
<img src="https://user-images.githubusercontent.com/73097560/115834477-dbab4500-a447-11eb-908a-139a6edaec5c.gif" width="100%">
---
## 📖 **Table of Contents**
- [🔍 Overview](#-overview)
- [⚙️ Vulnerability Chain](#️-vulnerability-chain)
- [🎯 Affected Versions](#-affected-versions)
- [✨ Features](#-features)
- [📦 Installation](#-installation)
- [🚀 Usage](#-usage)
- [Single Target Exploit](#-single-target-exploit)
- [Interactive Shell](#-interactive-shell)
- [Mass Exploitation](#-mass-exploitation)
- [📁 Target List Format](#-target-list-format)
- [🖼️ Screenshots](#️-screenshots)
- [🛡️ Mitigation](#️-mitigation)
- [📢 Channels & Community](#-channels--community)
- [⚠️ Disclaimer](#️-disclaimer