CVE-2026-109430

HIGH 7.5

Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.

CWE	CWE-611
Vendor	ellucian
Product	webadvisor
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for ellucian webadvisor

Be the first to know when new high vulnerabilities affecting ellucian webadvisor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Ellucian / WebAdvisor

3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ellucian.com: https://www.ellucian.com/ vulncheck.com: https://www.vulncheck.com/advisories/ellucian-webadvisor-unauthenticated-xxe-injection

Credits

Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp. Marisabel Bachour, Pentester, GM Sectec, Corp.