CVE-2026-6881: Ellucian Advance Web

Critical severity, CVSS 9.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all versions. Ellucian CRM Advance is not impacted.

Affected products

• Ellucian Advance Web: any version
• Ellucian Legacy Advance: any version

Published 2026-07-28. Last modified 2026-09-09.