CVE-2026-6881: Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-28 · updated 2026-09-09
Weakness: CWE-89

Description

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all versions. Ellucian CRM Advance is not impacted.

Affected products

Ellucian Advance Web: all versions
Ellucian Legacy Advance: all versions

References

https://labs.sra.io/posts/ellucian

Get alerted when CVE-2026-6881 or the next vulnerability affects your stack