CVE-2026-6881
Ellucian Advance Web and Legacy Advance contain a critical SQL injection flaw in the Giving Reports feature. An attacker who can log in can craft a query that reads sensitive database data. The vulnerability exists in all versions of both products.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Ellucian Advance Web (all versions) and Legacy Advance (all versions).
Real-world impact
An authenticated attacker can extract confidential information from the database, such as student or financial data, by inserting malicious SQL into the credit field of the Giving Reports form.
Why this severity
The CVSS score of 9.4 reflects the high impact of the vulnerability: it requires only low effort, is exploitable by an authenticated user, and can lead to complete disclosure of sensitive data. The high confidentiality and integrity impact ratings drive the critical score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources