CVE-2026-32856 is a reflected cross-site scripting vulnerability in Ellucian Banner Self-Service prior to the April T2 release (2025-04-23). The vulnerability arises from improper neutralization of input in the toDateFormat request parameter of the unauthenticated dateConverter endpoint. Attackers can craft malicious URLs that execute arbitrary JavaScript in victims' browsers, potentially leading to session cookie theft or other malicious actions within the victim's session context. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality, integrity, or availability impact, and low scope impact. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session via a reflected XSS vulnerability. This can lead to session cookie theft or other malicious actions performed with the victim's privileges in the application. The vulnerability does not directly impact confidentiality, integrity, or availability of the server but compromises user session security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking on untrusted links targeting the dateConverter endpoint. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the toDateFormat parameter may provide temporary mitigation.