Loading vulnerability…
SQL Injection and Unsafe Deserialization RCE in Koollab LMS
CVE-2026-63233 affects Three Learning's Koollab LMS version 5.3.2. SQL injection in the assessment overall answer endpoint allows an authenticated attacker to control data passed to unserialize(). Combined with unsafe deserialization, this enables the attacker to write a webshell to a publicly accessible location and execute arbitrary code on the server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated remote attacker can write and execute a publicly accessible webshell, resulting in arbitrary code execution on the Koollab LMS server.
If you can’t patch tonight, do this now.
Where immediate code remediation is not possible, reduce exposure by restricting access to the vulnerable functionality to only necessary authenticated roles, monitoring for anomalous use of assessment-related endpoints, detecting unexpected server-side file creation in web-accessible directories, and hardening the runtime to prevent execution of unauthorized uploaded or generated script content. Additional compensating controls include database query anomaly monitoring, least-privilege filesystem permissions, and application-layer protections that block SQL injection patterns.
Patch, then assume compromise.
Three Learning deployed fixes for all reported vulnerabilities, including CVE-2026-63233, across all cloud-hosted Koollab LMS instances on April 26, 2026. No customer-side manual update or patching is required for the SaaS application. A fixed version identifier is not specified.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.