CVE-2026-109430
CVE-2026-109430 · Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
CVSS 8.7 · High · EPSS 0.3%
- Published
- Updated
Affected products and versions
webadvisor
- Versions
- 3.2: Affected (custom)
No fix published