Vulnerability Description
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://www.ellucian.com/assets/en/brochure/brochure-learn-more-about-ellucian-b
- https://www.ellucian.com/security-researcher-hall-of-fame
- https://www.vulncheck.com/advisories/ellucian-banner-self-service-stored-xss-via
FAQ
What is CVE-2026-47106?
CVE-2026-47106 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users...
How severe is CVE-2026-47106?
CVE-2026-47106 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47106?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.