CVE-2026-47106

MediumCVSS 5.4

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Ellucian Banner Self-Service before the April 2025 release (2025-04-23) contains a stored XSS vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with write access can store malicious JavaScript in fields like displayName, emailAddress, subjectDescription, or courseTitle; these values are then served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing script execution in any user's browser who views the affected course's meeting times.

Risk Assessment

The risk involves potential script execution in multiple users' browsers, which could lead to data theft, session hijacking, or malware propagation within the organization.

Recommendation

Immediately update Ellucian Banner Self-Service to the April 2025 release or later and implement HTML encoding for all data rendered in the DOM.

Other vulnerabilities in Ellucian Banner Self-Service

CVE-2026-32856Medium
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting unsanitized input through the toDateFormat request parameter in the dateConverter endpoint. Attackers can craft a malicious URL targeting the unauthenticated dateConverter endpoint to steal session cookies or perform other malicious actions in the context of the victim's browser session.

Original NVD description (English source)

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS