Is CVE-2026-38671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38671 being exploited in the wild.

How severe is CVE-2026-38671?

Informational severity, published 19 October 2026.

Which products and versions are affected?

Ellucian Banner Student Registration Self-Service 9.23 and prior.

Is there a fix for CVE-2026-38671?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38671 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-38671?

Check whether you run Ellucian Banner Student Registration Self-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38671: Ellucian Banner Student Registration Self-Service cross-site scripting

CVE-2026-38671 · Severity: info · Published 2026-10-19

Ellucian Banner Student Registration Self-Service is a web portal used by educational institutions for student enrollment and course registration. A cross-site scripting vulnerability in the registration endpoint allows an attacker to inject malicious code that executes in a student's browser, potentially stealing credentials, personal information, or session tokens. No patch is available for affected versions.

Vendors: Ellucian.

Quick answers

Is CVE-2026-38671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38671 being exploited in the wild.
How severe is CVE-2026-38671?: Informational severity, published 19 October 2026.
Which products and versions are affected?: Ellucian Banner Student Registration Self-Service 9.23 and prior.
Is there a fix for CVE-2026-38671?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38671 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-38671?: Check whether you run Ellucian Banner Student Registration Self-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting vulnerability exists in the /ssb/registration endpoint via the mepCode parameter in StudentRegistrationSsb version 9.23 and earlier. The vulnerability requires the victim to click a malicious link containing injected JavaScript. Successful exploitation allows arbitrary script execution in the victim's browser context, enabling session hijacking, credential theft, or malware distribution.

Affected products

Ellucian Banner Student Registration Self-Service 9.23 and prior

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.