Ellucian WebAdvisor EUVD-2026-101808

Exploitation requires that the target run Ellucian WebAdvisor 3.2 with the /WebAdvisor/WebAdvisor endpoint reachable by the attacker, and that the XML parser be left in its vulnerable default state with external entity and DTD resolution enabled (the description states the flaw occurs 'without disabling' these - i.e. the default configuration is exploitable). No authentication, credentials, or user interaction are needed (PR:N/UI:N). Full impact depends on environment specifics: NTLMv2 hash coercion requires the WebAdvisor server to be able to make outbound SMB (TCP 445) connections to an attacker-controlled share, and arbitrary file read and SSRF depend on the Windows host and reachable internal targets. Limiting factors that reduce real-world exposure: the product is end-of-support (June 2022), so it is only present in legacy higher-education deployments; outbound SMB egress filtering would blunt the NTLM-theft vector; and impact is confined to confidentiality (no integrity or availability effect).

The input CVSS 4.0 base score of 8.7 (High) is driven by a maximally favorable attacker profile for the vulnerable component: AV:N/AC:L/AT:N/PR:N/UI:N means remote, low-complexity, unauthenticated exploitation with no user interaction, and VC:H reflects full confidentiality compromise (arbitrary file read, SSRF, and NTLMv2 hash coercion). Integrity and availability are untouched (VI:N/VA:N), so this is a disclosure/credential-theft issue rather than an RCE or DoS. However, the exploitation-likelihood signals are absent or point to limited urgency: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The key tension is severity versus footprint: WebAdvisor entered end-of-support in June 2022, so the affected population is narrow and shrinking (higher-education institutions still running the legacy portal), which caps mass-exploitation potential but also means there is no official patch - remediation requires migrating to Colleague Self-Service. Net assessment: for any organization still exposing WebAdvisor 3.2, this is a real and actionable priority because unauthenticated file read plus NTLMv2 hash capture is directly weaponizable for credential relay and lateral movement; across the broader internet it is lower-urgency due to the small, legacy deployment base. Note that EPSS/KEV/POC data is missing rather than confirmed-negative, so 'no known exploitation' should be read as absence of evidence, not evidence of absence.

A remote, unauthenticated attacker sends a crafted XML POST request to the /WebAdvisor/WebAdvisor endpoint containing an external entity that references an attacker-controlled SMB share; because the parser does not disable external entity and DTD resolution, the Windows server initiates an outbound SMB connection and leaks its NTLMv2 authentication hash, which the attacker captures and relays or cracks offline. The same XXE primitive is used to perform SSRF against internal services and to read arbitrary files from the Windows host via an out-of-band error-based channel. No public exploit is identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile makes reliable exploitation straightforward with standard XXE tooling.