CVE-2026-109430
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection…
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SS…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Last activity 15 Oct 2026. Patch Forecast updates every hour.