Read the docs
TI-2026-34704 Aliases CVE-2026-47106GHSA-pgpc-33v2-x2qg

Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed Banner Self-Service (Ellucian): April T2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EllucianBanner Self-Servicebefore April T2; 9.41 and laterApril T2Patch availableCNA
  • Banner Self-Service VendorEllucian Affected before April T2; 9.41 and later Fixed in April T2 Patch available CNA

Remediation

  • Fix · CNA Banner Self-Service (Ellucian) Fixed in April T2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ellucian Banner Self-Service April T2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-25318 Ellucian Banner Self-Service Reflected XSS via dateConverterPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47106
  2. 2026-10-03 Alias added: GHSA-pgpc-33v2-x2qg

References

Advisory 1

Other 1

  • TI-2023-26952 Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified… CVSS 3.1MEDIUM 6.5
  • TI-2023-02643 Ellucian Ethos Identity logout cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2015-03926 Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2026-74567 Unauthenticated XXE injection in Ellucian WebAdvisor CVSS 4.0HIGH 8.7
  • TI-2019-06469 An improper authentication vulnerability can be exploited through a race condition that… CVSS 3.0HIGH 8.1
  • TI-2026-06035 SQL injection in Ellucian Advance Web CVSS 4.0CRITICAL 9.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences