Ellucian Banner Student CVE-2026-38671

Exploitation requires a victim user to open an attacker-crafted link to the /ssb/registration endpoint carrying a malicious payload in the mepCode parameter; the injected script then executes in that user's browser context (reflected XSS). The key limiting factor is required user interaction (UI:R) - the attacker cannot trigger it without a victim clicking/visiting the crafted URL - so it is well-suited to phishing but not self-propagating. No attacker authentication is needed to craft the link (PR:N), but impact is scoped to whatever session/context the victim holds in StudentRegistrationSsb. Aggravating condition: all versions 9.23 and prior are affected with no vendor-supplied fix, so defenders must rely on WAF/input-output encoding or network controls rather than patching.

This is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - network-reachable and requiring no attacker privileges, but gated by victim user interaction (UI:R), which materially lowers real-world urgency relative to a no-interaction flaw. The scope change (S:C) reflects script execution crossing into the victim's browser/authentication context rather than any server compromise; confidentiality and integrity impact are Limited and availability is None, so this is session/browser-level impact, not server takeover. No EPSS score and no CISA KEV status were provided in the input, and there is no evidence of active exploitation, so by the precision rules this is 'no public exploit identified at time of analysis' for KEV purposes; however, a GitHub gist is referenced (gist.github.com/xAR191/...), which strongly suggests publicly available exploit/POC code exists, though it was not independently verified. Net: a moderate-priority, interaction-dependent XSS, NOT a critical-exploitation emergency - but notably aggravated by the vendor providing NO fixed version (9.23 and prior all affected), so compensating controls are the only mitigation. CONFLICT TO VERIFY: the description and a tag label this 'arbitrary code execution'/RCE, but the CWE (79) and CVSS impact metrics (no A impact, only L/L on C/I with S:C) are consistent with XSS, not server-side RCE - treat the 'RCE' framing as inaccurate.

An attacker crafts a URL to the /ssb/registration endpoint with a malicious JavaScript payload in the mepCode parameter and delivers it (e.g., via phishing) to a student or registration-system user. When the victim opens the link, the payload is reflected and executes in their authenticated browser session, allowing theft of session tokens or manipulation of registration data shown to the user. A proof-of-concept appears to be published in the referenced GitHub gist.