A critical vulnerability identified as CVE-2026-63232 affects Koollab LMS, combining SQL injection with unsafe deserialisation. An authenticated attacker can exploit the assessment reinforcement endpoint to inject malicious data, manipulate inputs passed to PHP's unserialize() function, and ultimately achieve remote code execution. The attack chain allows writing a webshell to a publicly accessible server location, granting persistent access. The vulnerability requires authentication but is considered high severity due to its RCE impact. It has been reported by NVD (NIST) and flagged by Singapore's Cyber Security Agency (CSA) as an active advisory.