CVE-2026-109430 Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
Unauthenticated XXE in Ellucian WebAdvisor allows attackers to read files, disclose hashes, and perform SSRF; product is end-of-life.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109430?
CVE-2026-109430 is a high-severity vulnerability in Ellucian WebAdvisor, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Weakness: CWE-611
Which versions are affected by CVE-2026-109430?
How do I fix CVE-2026-109430?
No fix has been published for CVE-2026-109430 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109430 being exploited?
There is no known exploitation of CVE-2026-109430 in the wild and no public exploit code.
Sources
Also known as GHSA-5g3c-r9vp-q6pp.