CVE-2026-109430 is an unauthenticated XXE injection flaw in Ellucian WebAdvisor 3.2, triggered by sending crafted XML to the /WebAdvisor/WebAdvisor endpoint since external entity and DTD resolution aren't disabled. An attacker can abuse it to trigger SSRF, leak NTLMv2 hashes via a malicious SMB share, or pull arbitrary files off the underlying Windows server through an out-of-band error channel. No authentication is required to exploit it.
// source: nvd.nist.gov ↗