CVE-2026-6881: Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

Published Jul 28, 2026

Updated

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.

This issue affects Advance Web: all versions; Legacy Advance: all versions.

Ellucian CRM Advance is not impacted.

Affected Software

2 affected components

Ellucian Advance Web=

Ellucian Legacy Advance=

Event History

Jul 28, 2026

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-6881?

CVE-2026-6881 has a critical severity rating of 9.4 according to the CVSS scoring system.

How do I fix CVE-2026-6881?

To fix CVE-2026-6881, it is essential to apply the latest patches and updates provided by Ellucian for both Advance Web and Legacy Advance.

What systems are affected by CVE-2026-6881?

CVE-2026-6881 affects all versions of Ellucian Advance Web and Legacy Advance.

What type of vulnerability is CVE-2026-6881?

CVE-2026-6881 is classified as a SQL Injection vulnerability.

What can an attacker do with CVE-2026-6881?

An authenticated attacker can exploit CVE-2026-6881 to extract sensitive information from databases by executing crafted SQL queries.