CVE-2026-6881 describes a SQL Injection vulnerability in the Giving Reports feature of Ellucian Advance Web and Legacy Advance products. The vulnerability allows an attacker with valid authentication to inject malicious SQL code via the class credit field, enabling unauthorized extraction of sensitive database information. Both Ellucian Advance Web and Legacy Advance in all versions are affected, while Ellucian CRM Advance is not impacted. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the database. Since the attacker must be authenticated, the risk is limited to users with valid credentials but remains critical due to the potential exposure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users and monitor for suspicious activity related to the class credit field inputs.