CVE-2026-109430: Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable external entity and DTD resolution for XML processing on the /WebAdvisor/WebAdvisor endpoint.
Ellucian WebAdvisor 3.2 external entity and DTD resolution = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
WebAdvisor 3.2 deployments that expose the /WebAdvisor/WebAdvisor endpoint to remote requests are exposed. Exploitation does not require authentication or user interaction.
What can an attacker do with this issue?
An attacker can submit crafted XML POST requests to trigger server-side requests, including requests to attacker-controlled SMB shares that may disclose NTLMv2 hashes. The flaw can also be used to read arbitrary files from the underlying Windows host through an out-of-band error-based channel.
What is the recommended remediation?
WebAdvisor has been end of support since June 2022. Users are encouraged to migrate to Colleague Self-Service.