CVE-2026-6881

CriticalCVSS 9.4/10Last modified Sep 9, 2026

Description

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.

This issue affects Advance Web: all versions; Legacy Advance: all versions.

Ellucian CRM Advance is not impacted.

Metrics

CVSS 4.0 9.4/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 28, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-688107.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688117.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locaCVE-2026-688127.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688135.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-688147.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688157.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688167.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688177.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-688197.5Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.CVE-2026-688207.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-688217.8Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.CVE-2026-688239.1Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
CVE-2026-6881: Critical severity, CVSS 9.4 | Vulnix