CVE-2026-109430: Unauthenticated XXE Injection in Ellucian WebAdvisor 3.2
A critical vulnerability (CVE-2026-109430) has been discovered in Ellucian WebAdvisor 3.2, an unauthenticated XML External Entity (XXE) injection flaw that allows remote attackers to exploit the server for SSRF requests, NTLMv2 hash disclosure, and arbitrary file reading. The vulnerability has a CVSS score of 7.5 and is considered high severity. WebAdvisor has been in end-of-support status since June 2022, and users are encouraged to migrate to Colleague Self-Service. Immediate patching or migration is strongly recommended.