CVE-2026-109430
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated XXE Injection in Ellucian WebAdvisor 3.2

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-109430
EUVD
EUVD-2026-101808

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Ellucian WebAdvisor 3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ellucian WebAdvisor 3.2 has an unauthenticated XML External Entity (XXE) injection vulnerability. Attackers can send specially crafted XML requests to the /WebAdvisor/WebAdvisor endpoint without proper security checks. This allows them to force the server into making unintended network requests, steal NTLMv2 hashes via SMB shares, and read files from the underlying Windows system.

Detection Guidance

Detecting this XXE vulnerability requires testing the /WebAdvisor/WebAdvisor endpoint with crafted XML payloads. Use tools like curl to send XML POST requests with external entity references. Example: curl -X POST -d @xxe_payload.xml http://target/WebAdvisor/WebAdvisor. Monitor for SSRF attempts, NTLMv2 hash leaks, or file read errors. Network traffic analysis for unusual SMB or HTTP requests may also indicate exploitation attempts.

Impact Analysis

This vulnerability can lead to serious consequences such as unauthorized access to sensitive data, exposure of internal network resources, and potential compromise of user credentials. Attackers could exploit it to read files on the server, perform network reconnaissance, or launch further attacks within the network.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized data access risks, potential exposure of personal or health information, and lack of proper security controls. Organizations using affected versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Immediately migrate from WebAdvisor 3.2 to Colleague Self-Service as it is end-of-support. If migration is not feasible, restrict access to the /WebAdvisor/WebAdvisor endpoint via firewall rules. Disable external entity and DTD processing in XML parsers. Block outbound SMB traffic to untrusted networks. Monitor for unauthorized file access or SSRF attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart