Unauthenticated XXE Injection in Ellucian WebAdvisor

Ellucian WebAdvisor version 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability (CVE-2026-109430). The vulnerability stems from improper configuration of XML parsers within the /WebAdvisor/WebAdvisor endpoint, which fail to properly disable external entity and Document Type Definition (DTD) resolution. Remote attackers can leverage this flaw to send crafted XML POST requests to the application. Successful exploitation allows for server-side request forgery (SSRF), the coercion of NTLMv2 hash disclosure by forcing the server to authenticate against attacker-controlled SMB shares, and the reading of arbitrary local files from the underlying Windows host via error-based exfiltration. As Ellucian WebAdvisor reached end-of-support in June 2022, there are no patches available for this vulnerability. Organizations using this software are at significant risk and are urged to migrate to Colleague Self-Service immediately.

Impact

Successful exploitation results in full server-side information disclosure and potential credential theft. Attackers can bypass authentication to read sensitive configuration files, system files, or application data. Furthermore, the ability to coerce the server into performing SMB authentication provides a vector for lateral movement or credential harvesting through NTLMv2 relay attacks. Given the nature of the software in higher education environments, this impact could lead to the broad compromise of institutional sensitive data.

Recommendation

• Identify and isolate all remaining instances of Ellucian WebAdvisor in the environment, as the software is no longer supported and cannot be patched.
• Migrate all workflows currently relying on WebAdvisor to Colleague Self-Service or an alternative supported platform.
• Implement restrictive network egress rules for all servers previously running WebAdvisor to prevent SSRF and SMB-based hash exfiltration.
• Monitor IIS web server logs for HTTP POST requests to /WebAdvisor/WebAdvisor containing XML structures with DTD definitions or external entity declarations.