Key points
- CVE-2026-109430 affects Ellucian WebAdvisor 3.2 with a CVSS score of 8.7.
- The vulnerability allows unauthenticated XML External Entity injection.
- Ellucian ended support for WebAdvisor in June 2022.
Ellucian WebAdvisor 3.2 contains a high-severity security flaw identified as CVE-2026-109430. The vulnerability is an unauthenticated XML External Entity injection that affects the specific version 3.2 of the software. Security researchers have assigned it a CVSS base score of 8.7, classifying the risk as high. This issue allows remote attackers to exploit the system without needing valid login credentials.
In plain English
The flaw exists in how the software processes XML data. Attackers can send specially crafted POST requests to the /WebAdvisor/WebAdvisor endpoint. These requests bypass standard security checks because external entity and DTD resolution are not disabled. This allows the server to process dangerous instructions embedded within the XML data.
The background
According to the National Vulnerability Database, this weakness is categorized under CWE-611. The unauthenticated nature of the flaw means any internet-connected attacker can target it. Exploitation can force the server to make Server-Side Request Forgery requests. Attackers can also coerce the disclosure of NTLMv2 hashes by directing the server to attacker-controlled SMB shares.
What changes now
Exploiting this vulnerability allows attackers to read arbitrary files from the underlying Windows host. This is achieved through an out-of-band error-based channel. Since Ellucian WebAdvisor entered end-of-support status in June 2022, no security patches are being developed. Users are encouraged to migrate to Colleague Self-Service to eliminate this risk.
Who needs to act first
Security teams should immediately identify all instances of Ellucian WebAdvisor 3.2 in their environment. Prioritize isolating systems that are directly exposed to the internet or untrusted networks. Verify whether the application is still in active use or if migration to Colleague Self-Service has occurred. If the system must remain online, implement strict network segmentation to block external access. Review firewall rules to deny inbound traffic to the WebAdvisor endpoint. Monitor logs for unusual XML processing errors or outbound connections to SMB shares.
Background: XML external entity (XXE) attacks
Developers leave XML parsers vulnerable by failing to disable external entity processing or by trusting unvalidated input. These mistakes allow attackers to read local files, trigger server-side requests, or cause denial of service. Fix each issue by explicitly disabling entity resolution in your parser configuration or by switching to a safer data format like JSON.
Read the full guide: 7 Configuration Mistakes That Enable XML External Entity Attacks
What to do and how to stay safe: Ellucian
- Scan network assets to locate any running instances of Ellucian WebAdvisor 3.2.
- Block external access to the /WebAdvisor/WebAdvisor endpoint via firewall rules.
- Monitor server logs for signs of XML parsing errors or unexpected outbound traffic.
- Plan migration to Colleague Self-Service as the vendor no longer supports WebAdvisor.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109430?
The National Vulnerability Database rates the severity as 8.7, which is considered high.
Is there a patch available for this vulnerability?
No, Ellucian WebAdvisor entered end-of-support status in June 2022, so no fixes are provided.
How can attackers exploit this flaw?
Attackers can submit crafted XML POST requests to force SSRF, steal NTLMv2 hashes, or read files.
