CVE-2026-109430 is a high severity unauthenticated XML external entity flaw (CVSS 7.5) in Ellucian WebAdvisor 3.2. Remote attackers can send crafted XML to the main endpoint. The product reached end of support in June 2022, so the practical answer is to migrate to Colleague Self-Service.
What's affected
The record says Ellucian WebAdvisor 3.2 is affected, and VulnCheck's advisory, which we fetched, lists WebAdvisor up to 3.2. Neither source names a fixed version. The record says WebAdvisor entered end of support in June 2022 and that users are encouraged to move to Colleague Self-Service, so a patch is unlikely. The advisory page links the vendor homepage but gives no patch.
The weakness is CWE-611, improper restriction of XML external entity reference. The record's vector is network reachable, low complexity, no privileges and no interaction, with high confidentiality impact only. VulnCheck gives a CVSS 4.0 score of 8.7 against the 7.5 in the record.
The record says the flaw is in the /WebAdvisor/WebAdvisor endpoint, which processes XML without disabling external entity and DTD resolution. It lists three consequences: server side request forgery, coerced disclosure of NTLMv2 hashes through an attacker controlled SMB share, and reading arbitrary files on the Windows host through an out of band error based channel.
How to check if you're exposed
Find out whether you still run WebAdvisor. Look in your web server and application inventory for the path /WebAdvisor and ask the student information system team directly, since this product served academic institutions for registration and records.
If it exists, check whether it is reachable from the internet:
curl -sI https://your-college.example/WebAdvisor/WebAdvisor
Run that only against your own domain. A response from outside your network means the endpoint is exposed.
Also check egress from the server. The record describes server side requests and SMB connections to attacker systems, so a server that can reach arbitrary outside hosts and SMB shares has more exposure. Review firewall rules for outbound SMB and general web access from the host.
What to do now
- Plan the move to Colleague Self-Service, as the record recommends, and set a date to switch off WebAdvisor.
- Until then, take the endpoint off the public internet or put it behind a VPN or an access proxy.
- Block outbound SMB (ports 139 and 445) and unneeded outbound web access from the server.
- Run the application account with the least rights, and keep sensitive files out of the readable areas of the host.
- Review logs for unusual XML posts to the endpoint and for outbound connections from the server to unfamiliar hosts, and reset credentials if you suspect disclosure.
Why it matters
XML lets a document define external entities, references that the parser fetches from a file path or a web address while reading. If a server parses XML from untrusted users and leaves that feature on, the user decides what the server reads and where it connects. The standard fix is to turn off external entity and DTD processing in the parser, which the record says was not done.
The three outcomes in the record all follow from one switch. The server can be made to request internal addresses, which is request forgery. It can be made to connect to a share the attacker runs, which hands over a Windows authentication hash. And it can be made to leak the contents of local files through error messages.
The larger problem is lifecycle. Software that has left support gets no fixes, so each new finding stays open. For education systems that hold student records, the sound answer is to retire the product. The record does not mark this CVE as known exploited.
Quick check
Will Ellucian patch this?
The record says WebAdvisor has been end of support since June 2022 and recommends migrating. No patch is named.
Why block SMB outbound?
The record says the flaw can coerce NTLMv2 hash disclosure through an attacker controlled SMB share. Blocking outbound SMB removes that path.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
