Read the docs
TI-2026-25318 Aliases CVE-2026-32856GHSA-x7x7-w9rf-g664

Ellucian Banner Self-Service Reflected XSS via dateConverter

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting unsanitized input through the toDateFormat request parameter in the dateConverter endpoint. Attackers can craft a malicious URL targeting the unauthenticated dateConverter endpoint to steal session cookies or perform other malicious actions in the context of the victim's browser session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed Banner Self-Service (Ellucian): April T2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EllucianBanner Self-Servicebefore April T2; 9.23 and laterApril T2Patch availableCNA
  • Banner Self-Service VendorEllucian Affected before April T2; 9.23 and later Fixed in April T2 Patch available CNA

Remediation

  • Fix · CNA Banner Self-Service (Ellucian) Fixed in April T2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ellucian Banner Self-Service April T2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-34704 Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes APIPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32856
  2. 2026-10-03 Alias added: GHSA-x7x7-w9rf-g664

References

Other 2

  • TI-2023-26952 Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified… CVSS 3.1MEDIUM 6.5
  • TI-2023-02643 Ellucian Ethos Identity logout cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2015-03926 Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2026-74567 Unauthenticated XXE injection in Ellucian WebAdvisor CVSS 4.0HIGH 8.7
  • TI-2019-06469 An improper authentication vulnerability can be exploited through a race condition that… CVSS 3.0HIGH 8.1
  • TI-2026-06035 SQL injection in Ellucian Advance Web CVSS 4.0CRITICAL 9.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences