CVE-2026-32856: Ellucian Banner Self-Service Reflected XSS via dateConverter
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting unsanitized input through the toDateFormat request parameter in the dateConverter endpoint. Attackers can craft a malicious URL targeting the unauthenticated dateConverter endpoint to steal session cookies or perform other malicious actions in the context of the victim's browser session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ellucian Banner Self-Service (dateConverter endpoint reflected XSS)to a version that resolves this vulnerability.Fixed in April T2 release (2025-04-23) - Compensating control
Block or restrict unauthenticated access to the dateConverter endpoint / toDateFormat request parameter at the network/WAF/ACL until the April T2 (2025-04-23) release is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32856?
The severity of CVE-2026-32856 is rated as medium with a score of 5.1.
What does CVE-2026-32856 vulnerability affect?
CVE-2026-32856 affects Ellucian Banner Self-Service software prior to the April T2 release.
How do I fix CVE-2026-32856?
To remediate CVE-2026-32856, upgrade Ellucian Banner Self-Service to the April T2 release or later.
What type of vulnerability is CVE-2026-32856?
CVE-2026-32856 is a reflected cross-site scripting (XSS) vulnerability.
Can attackers exploit CVE-2026-32856 to execute JavaScript?
Yes, CVE-2026-32856 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser.