Read the docs
TI-2026-74567 Aliases CVE-2026-109430

Unauthenticated XXE injection in Ellucian WebAdvisor

Priority MEDIUM 44CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

Ellucian WebAdvisor from 3.2 has an XML external entity injection flaw because it does not disable external entity and DTD resolution (CWE-611). An unauthenticated remote attacker can submit a crafted XML POST request to the /WebAdvisor/WebAdvisor endpoint to force server-side requests, capture NTLMv2 hashes through attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EllucianWebAdvisor3.2—No fix listedCNA
  • WebAdvisor VendorEllucian Affected 3.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Ellucian WebAdvisor. WebAdvisor entered end of support in June 2022, and the source description encourages users to migrate to Colleague Self-Service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-109430
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2023-26952 Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified… CVSS 3.1MEDIUM 6.5
  • TI-2023-02643 Ellucian Ethos Identity logout cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2015-03926 Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2019-06469 An improper authentication vulnerability can be exploited through a race condition that… CVSS 3.0HIGH 8.1
  • TI-2026-06035 SQL injection in Ellucian Advance Web CVSS 4.0CRITICAL 9.4
  • TI-2015-04238 Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through… CVSS 3.0MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences