# CVE-2026-109430: Ellucian WebAdvisor XXE injection

Source: https://junglewise.ai/threats/cve-2026-109430-ellucian-webadvisor-3-2-contains-an-unauthenticated-xml-external  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109430 · Severity: high · CVSS 7.5 · Published 2026-10-15

Ellucian WebAdvisor is an academic advising portal used by educational institutions. An unauthenticated attacker can submit malicious XML requests to read sensitive files from the server, steal Windows credentials, or make the server connect to attacker-controlled systems. This vulnerability affects WebAdvisor 3.2, which has been unsupported since June 2022.

Vendors: [Ellucian](https://junglewise.ai/threats/vendors/ellucian).

## Quick answers

**Is CVE-2026-109430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109430 being exploited in the wild.

**How severe is CVE-2026-109430?** High severity, with a CVSS score of 7.5, published 15 October 2026.

**Which products and versions are affected?** Ellucian WebAdvisor 3.2.

**Is there a fix for CVE-2026-109430?** No fixed version is recorded yet. Migrate to Ellucian Colleague Self-Service, which replaces the unsupported WebAdvisor product. If migration is not immediately possible, restrict network access to the /WebAdvisor/WebAdvisor endpoint and disable XML external entity processing at the application level. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109430 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109430?** Check whether you run Ellucian WebAdvisor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Migrate to Ellucian Colleague Self-Service, which replaces the unsupported WebAdvisor product. If migration is not immediately possible, restrict network access to the /WebAdvisor/WebAdvisor endpoint and disable XML external entity processing at the application level.

## Technical details

The /WebAdvisor/WebAdvisor endpoint fails to disable external entity and DTD resolution when processing XML POST requests, enabling XXE injection. An unauthenticated remote attacker can exploit this to trigger server-side request forgery (SSRF), extract arbitrary files via out-of-band error channels, or coerce NTLMv2 hash disclosure. No fix is available for this end-of-support product.

## Affected products

- Ellucian WebAdvisor 3.2

## Timeline

- 2026-10-15: disclosed

## References

- [https://www.ellucian.com/](https://www.ellucian.com/)
- [https://www.vulncheck.com/advisories/ellucian-webadvisor-unauthenticated-xxe-injection](https://www.vulncheck.com/advisories/ellucian-webadvisor-unauthenticated-xxe-injection)