Is CVE-2026-47106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47106 being exploited in the wild.

How severe is CVE-2026-47106?

Medium severity, with a CVSS score of 5.4, published 9 June 2026.

Which products and versions are affected?

Ellucian Banner Self-Service Before April T2 release (2025-04-23).

Is there a fix for CVE-2026-47106?

A patch was published on 2025-04-23: Fixed in April T2 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47106 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47106?

Check whether you run Ellucian Banner Self-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47106: Ellucian Banner Self-Service stored XSS in course search functionality

CVE-2026-47106 · Severity: medium · CVSS 5.4 · Published 2026-06-09

Ellucian Banner Self-Service, a platform used by higher education institutions for student and faculty administrative tasks, contains a security flaw in its course search feature. An authenticated user can inject malicious scripts into course or faculty information fields, which are then executed when other users view those records. This could allow an attacker to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of faculty and staff.

Vendors: Ellucian.

Quick answers

Is CVE-2026-47106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47106 being exploited in the wild.
How severe is CVE-2026-47106?: Medium severity, with a CVSS score of 5.4, published 9 June 2026.
Which products and versions are affected?: Ellucian Banner Self-Service Before April T2 release (2025-04-23).
Is there a fix for CVE-2026-47106?: A patch was published on 2025-04-23: Fixed in April T2 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47106 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47106?: Check whether you run Ellucian Banner Self-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Ellucian Banner Self-Service due to improper neutralization of input during web page generation (CWE-79). The vulnerability is located within the course search functionality, specifically where the application fails to perform HTML encoding during DOM insertion of data retrieved from the database. An attacker can leverage the unauthenticated 'getFacultyMeetingTimes' API endpoint to inject malicious JavaScript into various fields, including faculty displayName, emailAddress, subjectDescription, and courseTitle. When an authenticated user later views the affected course or faculty records, the stored script executes in the context of their browser session. This requires the attacker to have network access and at least low-level authenticated privileges to the ERP system to facilitate the injection, though the API endpoint itself is described as unauthenticated.

Affected products

Ellucian Banner Self-Service Before April T2 release (2025-04-23)

Timeline

2025-04-23: patched: Fixed in April T2 release
2026-06-09: advisory: NVD and VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.