CVE-2026-109430: Improper Restriction of XML External Entity Reference in Ellucian WebAdvisor
Description
Ellucian WebAdvisor 3.2 has an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to send crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint. This flaw enables server-side request forgery (SSRF), disclosure of NTLMv2 hashes via attacker-controlled SMB shares, and arbitrary file reading from the Windows host through an out-of-band error channel. WebAdvisor reached end-of-support in June 2022, and users are advised to migrate to Colleague Self-Service.
CVSS v4.0
Score 8.7high
Affected software
Ellucian
WebAdvisor
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109430 is an unauthenticated XXE vulnerability in Ellucian WebAdvisor version 3.2. The vulnerability arises because external entity and DTD resolution are not disabled when processing XML POST requests to the /WebAdvisor/WebAdvisor endpoint. Exploitation can lead to SSRF, NTLMv2 hash disclosure through SMB shares controlled by the attacker, and arbitrary file reading on the Windows host via out-of-band error-based channels. The product is no longer supported as of June 2022, and no patch or fix is provided.
Potential Impact
Successful exploitation allows remote attackers to perform SSRF attacks, obtain NTLMv2 hashes that could be used for further attacks, and read arbitrary files on the underlying Windows server. These impacts can lead to information disclosure and potentially facilitate further compromise of the affected system.
Mitigation Recommendations
WebAdvisor 3.2 is end-of-support since June 2022, and no official patch or fix is available. Users are strongly encouraged to migrate to Ellucian's Colleague Self-Service product. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T15:52:36.682Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad031392cdf04f656f4700a
Added to database: 10/15/2026, 01:49:45 UTC
Last enriched: 10/15/2026, 02:03:23 UTC
Last updated: 10/15/2026, 02:08:13 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.