CVE-2026-109430
7.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-611
Impact
Unauthenticated attackers can read arbitrary Windows files, trigger SSRF, and capture NTLMv2 hashes over the network. They only need HTTP access to send POST requests to the /WebAdvisor/WebAdvisor endpoint.
Root cause
The /WebAdvisor/WebAdvisor endpoint parses user-supplied XML with external entity and DTD resolution enabled.
Affected systems
Ellucian WebAdvisor 3.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Migrate to Ellucian Colleague Self-Service, as WebAdvisor reached end-of-support in June 2022 and has no patch. Immediately restrict network access to the /WebAdvisor/WebAdvisor endpoint or block outbound SMB traffic (port 445) from the host.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.