CVE-2026-47106: Ellucian Banner Stored XSS in Course Search—Remediation Guide

Technical summary

The vulnerability stems from missing HTML encoding during DOM insertion in Banner Self-Service's course search functionality. Specifically, the getFacultyMeetingTimes API endpoint serves faculty and course metadata (displayName, emailAddress, subjectDescription, courseTitle) that were stored without proper sanitization. An authenticated Banner ERP user with write permissions can craft malicious JavaScript payloads and persist them in these fields via the course search interface. Because the API endpoint is unauthenticated and returns unsanitized HTML content, any user who fetches meeting times receives and executes the attacker's injected script. The attack requires two distinct user roles: an insider or compromised account with ERP write access to plant the payload, and a target user accessing the self-service portal. This is classified as a stored XSS (CWE-79) rather than a reflected variant because the malicious script persists in the application's data store.

Business impact

This vulnerability enables account compromise, session hijacking, and credential theft for any user accessing course meeting times in Banner Self-Service. Faculty and students who regularly check schedules are exposed. For institutions, the risk includes reputational damage, potential regulatory compliance violations if student or employee data is exfiltrated, and operational disruption if attackers modify course information visible to users. The attack chain requires insider access or a compromised privileged account, limiting exposure to external threat actors but elevating risk from disgruntled staff or vendors with ERP write permissions. Institutions with shared administrative accounts or weak access controls face higher risk.

Affected systems

Ellucian Banner Self-Service versions prior to the April T2 release (2025-04-23) are affected. The specific vulnerable component is the course search functionality and the getFacultyMeetingTimes API endpoint. Only Banner instances configured to expose this self-service module are at risk. Institutions running patched or more recent releases are not affected.

Exploitability

Exploiting this vulnerability requires valid credentials with Banner ERP write access—a moderate barrier that limits opportunistic external attacks but poses significant insider risk. An attacker must first inject payloads into faculty or course fields, which requires familiarity with Banner's administrative interfaces. Once stored, the payload executes automatically whenever any user queries meeting times via the unauthenticated API, requiring no additional interaction from the attacker. The CVSS score of 5.4 (Medium) reflects the requirement for prior authentication, though the widespread exposure via an unauthenticated endpoint and the potential for persistent data exfiltration or session theft elevate practical concern. No active exploits have been added to CISA's Known Exploited Vulnerabilities catalog as of this writing.

Remediation

Apply the April T2 release (2025-04-23) or later versions of Ellucian Banner Self-Service immediately. This patch introduces proper HTML encoding for faculty and course metadata before DOM insertion. Organizations unable to patch immediately should restrict access to the getFacultyMeetingTimes API endpoint through network controls or Web Application Firewall (WAF) rules, enforce the principle of least privilege for Banner ERP write access, and monitor activity logs for suspicious modifications to faculty and course fields.

Patch guidance

Upgrade to Ellucian Banner Self-Service April T2 release (2025-04-23) or later. Before applying any patch, validate compatibility with your current Banner version and dependent systems, test in a non-production environment, and coordinate downtime with academic calendars to minimize disruption. Ellucian recommends reviewing your current release level in the Banner administration console (System Administration > Release Information). Consult Ellucian's official advisory for detailed step-by-step patching procedures and rollback instructions specific to your deployment architecture.

Detection guidance

Search application logs and web server access logs for requests to the getFacultyMeetingTimes endpoint, particularly those retrieving course metadata. Look for unusual patterns in faculty displayName, emailAddress, or course title fields—specifically entries containing HTML tags, JavaScript keywords (e.g., 'onclick', 'onerror', '<script>'), or URL-encoded special characters. Review Banner ERP audit logs for changes to course and faculty records made by unexpected user accounts or at unusual times. Implement a WAF rule to block requests containing common XSS payloads in API responses. Browser console errors or unexpected JavaScript execution on Banner Self-Service pages may also signal exploitation.

Why prioritize this

Although the CVSS score is Medium (5.4), the vulnerability merits prompt attention due to its stored nature—once injected, malicious payloads persist and affect all subsequent users—and the broad exposure through an unauthenticated API endpoint. The risk is elevated for institutions with weak access controls on Banner ERP write permissions or those using shared administrative credentials. However, active external exploitation appears unlikely without prior system access, making this lower priority than critical or high-severity vulns. Prioritize patching for institutions with high student or faculty access to the self-service portal.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a Medium severity assessment based on: (1) authentication requirement (PR:L)—only Banner ERP users with write access can inject payloads; (2) user interaction required (UI:R)—a victim must visit the course meeting times page; (3) changed scope (S:C)—the payload affects resources beyond the Banner ERP system; and (4) low impact on confidentiality and integrity (C:L, I:L), with no availability impact. The score does not heavily penalize the stored nature of the XSS or the widespread exposure via an unauthenticated API; therefore, practical risk may feel higher in environments with permissive ERP access controls or high self-service portal usage.

Frequently asked questions