Ellucian WebAdvisor: Unauthenticated XML External Entity (XXE) injection
Summary
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection in the /WebAdvisor/WebAdvisor endpoint. A remote attacker can send crafted XML POST requests without logging in, which may trigger server-side request forgery, capture NTLMv2 hashes via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host. WebAdvisor has been end-of-support since June 2022, so a vendor fix is unlikely. The risk is mainly relevant to higher-education institutions that still run WebAdvisor.
Affected
- Ellucian WebAdvisor 3.2
- Whether earlier versions are affected: Unknown.
Fixed in
Unknown. No fix or vendor security bulletin found. The product is end-of-support.
Workaround
- No vendor workaround published.
- Restrict access to /WebAdvisor/WebAdvisor at a reverse proxy or WAF, and remove direct internet exposure where possible.
- Block outbound SMB (TCP 445) and unrestricted outbound connections from the web server.
- Run the service account with minimal rights and disable or restrict NTLM where feasible.
Exploitation
- Not known to be exploited in the wild; not in CISA KEV.
- No public proof of concept found. The existence of the vulnerability is disputed by VulDB.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Check whether WebAdvisor is in use and whether it is reachable from the internet.
- Migrate to Colleague Self-Service, as recommended by the vendor.
- If WebAdvisor must stay online, apply the restrictions listed under workaround and monitor for unusual XML POST requests and unexpected outbound connections.
- Verify the final NVD scoring and check the vendor for an official bulletin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection www.vulncheck.com
- VulDB entry 420454 (disputed) vuldb.com
- OpenCVE: CVE-2026-109430 app.opencve.io
- HOL Guard: CVE-2026-109430 hol.org
- Vulners VulnRichment: CVE-2026-109430 vulners.com
- Rock Creek Community College: Self-Service FAQs (WebAdvisor end of support) rsccd.edu
- MassArt wiki: WebAdvisor retirement notice wiki.massart.edu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:40.
Original description (NVD)
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.