CVE-2026-66483

Summary

A critical PHP object injection vulnerability allows unauthenticated attackers to inject malicious PHP objects into the Education Center application, potentially leading to remote code execution and full system compromise.

Exploitability

Exploitation is relatively straightforward with no authentication required, though it may need a specific request pattern that triggers the deserialization process.

Blast radius

The vulnerability affects versions up to 3.6.12, making it potentially widespread across many installations that haven't yet updated.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Education Center version 3.6.13 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.