{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ellucian/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ellucian:webadvisor:3.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109430"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebAdvisor (3.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ellucian"],"content_html":"\u003cp\u003eEllucian WebAdvisor version 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability (CVE-2026-109430). The vulnerability stems from improper configuration of XML parsers within the /WebAdvisor/WebAdvisor endpoint, which fail to properly disable external entity and Document Type Definition (DTD) resolution. Remote attackers can leverage this flaw to send crafted XML POST requests to the application. Successful exploitation allows for server-side request forgery (SSRF), the coercion of NTLMv2 hash disclosure by forcing the server to authenticate against attacker-controlled SMB shares, and the reading of arbitrary local files from the underlying Windows host via error-based exfiltration. As Ellucian WebAdvisor reached end-of-support in June 2022, there are no patches available for this vulnerability. Organizations using this software are at significant risk and are urged to migrate to Colleague Self-Service immediately.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full server-side information disclosure and potential credential theft. Attackers can bypass authentication to read sensitive configuration files, system files, or application data. Furthermore, the ability to coerce the server into performing SMB authentication provides a vector for lateral movement or credential harvesting through NTLMv2 relay attacks. Given the nature of the software in higher education environments, this impact could lead to the broad compromise of institutional sensitive data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and isolate all remaining instances of Ellucian WebAdvisor in the environment, as the software is no longer supported and cannot be patched.\u003c/li\u003e\n\u003cli\u003eMigrate all workflows currently relying on WebAdvisor to Colleague Self-Service or an alternative supported platform.\u003c/li\u003e\n\u003cli\u003eImplement restrictive network egress rules for all servers previously running WebAdvisor to prevent SSRF and SMB-based hash exfiltration.\u003c/li\u003e\n\u003cli\u003eMonitor IIS web server logs for HTTP POST requests to /WebAdvisor/WebAdvisor containing XML structures with DTD definitions or external entity declarations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T04:35:09Z","date_published":"2026-10-15T04:35:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ellucian-xxe/","summary":"Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XXE injection, enabling remote attackers to perform SSRF, steal NTLMv2 hashes, and conduct arbitrary file read operations.","title":"Unauthenticated XXE Injection in Ellucian WebAdvisor","url":"https://feed.craftedsignal.io/briefs/2026-10-ellucian-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Ellucian","version":"https://jsonfeed.org/version/1.1"}