Is CVE-2026-6881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6881 being exploited in the wild.

How severe is CVE-2026-6881?

Informational severity, with a CVSS score of 9.4, published 28 July 2026.

Which products and versions are affected?

Ellucian Advance Web All versions before AWA-2022-ORA-17; Ellucian Legacy Advance All versions before AWA-2022-ORA-17.

Is there a fix for CVE-2026-6881?

A patch was published on 2026-05-15: Vendor releases hotfix AWA-2022-ORA-17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6881 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6881?

Check whether you run Ellucian Advance Web or Ellucian Legacy Advance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6881: Ellucian Advance SQL injection in Giving Reports

CVE-2026-6881 · Severity: info · CVSS 9.4 · Published 2026-07-28

Ellucian Advance, a software suite used by higher education institutions for fundraising and donor management, contains a security flaw in its reporting tools. An authorized user could exploit this vulnerability to gain unauthorized access to sensitive database information, potentially compromising donor records and financial data. This issue affects both the Web and Legacy versions of the product, but does not impact Ellucian CRM Advance.

Vendors: Ellucian.

Quick answers

Is CVE-2026-6881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6881 being exploited in the wild.
How severe is CVE-2026-6881?: Informational severity, with a CVSS score of 9.4, published 28 July 2026.
Which products and versions are affected?: Ellucian Advance Web All versions before AWA-2022-ORA-17; Ellucian Legacy Advance All versions before AWA-2022-ORA-17.
Is there a fix for CVE-2026-6881?: A patch was published on 2026-05-15: Vendor releases hotfix AWA-2022-ORA-17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6881 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6881?: Check whether you run Ellucian Advance Web or Ellucian Legacy Advance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists within the Giving Reports functionality of Ellucian Advance Web and Legacy Advance. The flaw is located in the 'class credit' field, where improper neutralization of special elements allows for the execution of arbitrary SQL commands. An authenticated attacker with network access can exploit this to extract sensitive data from the underlying database. The vulnerability affects all versions prior to the AWA-2022-ORA-17 hotfix. Ellucian CRM Advance is confirmed to be unaffected.

Affected products

Ellucian Advance Web All versions before AWA-2022-ORA-17
Ellucian Legacy Advance All versions before AWA-2022-ORA-17

Timeline

2026-04-24: disclosed: SRA submits vulnerability to vendor
2026-05-15: patched: Vendor releases hotfix AWA-2022-ORA-17
2026-07-28: advisory: SRA publishes CVE and advisory

References

https://labs.sra.io/posts/ellucian

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.