Advisory: Ellucian Advance

Tue, 28 Jul 2026 12:00:00 +0000

Summary

SRA has identified a SQL injection vulnerability in Ellucian Advance Web and Legacy Advance.

CVE Identifiers

CVE ID	CVE Name
CVE-2026-6881	Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

Vulnerability Details / Description

CVE-2026-6881 Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.

Severity

The CVSS severity level of this vulnerability has been calculated to be 9.4 (Critical)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Affected Versions and Models

Affects all versions of Ellucian Advance Web before AWA-2022-ORA-17.

Affects all versions of Ellucian Legacy Advance before AWA-2022-ORA-17.

Ellucian CRM Advance is not impacted.

MITRE CWE Weakness Enumeration

CWE-89 Improper neutralization of special elements used in an SQL command (‘SQL injection’)

Remediation Options

Apply hotfix AWA-2022-ORA-17.

Source

These vulnerabilities were discovered by Jeremy Slaven, Dylan Eliasson, and Mark Blaho as part of research performed by Security Risk Advisors.

Timeframe

April 24, 2026 - SRA submits vulnerability to vendor
May 15, 2026 - Vendor releases hotfix
July 28, 2026 - SRA publishes CVEs and advisory

CVE-2026-6881 on SRA Labs | Cybersecurity Research & Innovation by Security Risk Advisors