[NEW] [high] ILIAS: Multiple vulnerabilities

highCVE-2026-18745

An attacker can exploit multiple vulnerabilities in ILIAS to execute arbitrary code, perform SQL injection, disclose confidential information, bypass security measures, or trigger a denial-of-service condition.

CSIRTS triage

vendor: ILIAS product: ILIAS Remote code execution SQL injection Information disclosure Authentication bypass Denial of service

What: Multiple vulnerabilities in ILIAS allow remote code execution, SQL injection, information disclosure, authentication bypass, and denial of service.
Who is affected: All ILIAS installations accessible to network attackers.
Urgency: High severity with multiple attack vectors including RCE; patch immediately.
Action: Update ILIAS to the latest security release addressing CVE-2026-18745.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ILIAS

Get an email when a new ILIAS advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-27
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2774

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18745	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownCVE-2026-18745: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.nvd

Recent advisories for ILIAS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[UPDATE] [hoch] ILIAS: Mehrere Schwachstellencert-bund · 2026-09-14
lowCVE-2023-32778: An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitra…nvd · 2026-09-14
medium[UPDATE] [mittel] ILIAS: Mehrere Schwachstellencert-bund · 2026-09-08
mediumCVE-2026-86416: ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in i…nvd · 2026-09-07
highCVE-2026-82538: ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repo…nvd · 2026-09-04
mediumCVE-2026-85135: A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function i…nvd · 2026-09-03