Vulnerability · Published Jul 28, 2026 · Assigned by SRA
CVE-2026-6881Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance
Critical 9.4
In plain English
A critical-severity SQL injection in Advance Web from Ellucian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all versions. Ellucian CRM Advance is not impacted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ellucian | Advance Web | 0 – through * |
| Ellucian | Legacy Advance | 0 – through * |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
References
- https://labs.sra.io/posts/ellucian third-party-advisory