CVE-2026-47106: Ellucian Banner Self-Service XSS Flaw

CVE-2026-47106 Overview

CVE-2026-47106 is a stored cross-site scripting (XSS) vulnerability in Ellucian Banner Self-Service prior to the April T2 release dated 2025-04-23. The flaw resides in the course search functionality and stems from missing HTML encoding during DOM insertion. Authenticated Banner ERP users with write access can inject JavaScript payloads into faculty and course metadata fields, including displayName, emailAddress, subjectDescription, and courseTitle. The unauthenticated getFacultyMeetingTimes API endpoint subsequently serves these values without sanitization, executing the attacker's script in any viewer's browser. The vulnerability is classified under CWE-79.

Critical Impact
An authenticated Banner ERP user can store JavaScript that executes in the browser of any unauthenticated visitor who views course meeting times, enabling session theft, phishing, and content manipulation across the institution's self-service portal.

Affected Products

Ellucian Banner Self-Service releases prior to April T2 (2025-04-23)
Banner ERP deployments exposing the getFacultyMeetingTimes API endpoint
Course search and faculty meeting times views within Banner Self-Service

Discovery Timeline

2026-06-09 - CVE-2026-47106 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47106

Vulnerability Analysis

The vulnerability exists because Banner Self-Service inserts faculty and course metadata directly into the DOM without applying HTML encoding. An authenticated Banner ERP user with write permission can place JavaScript into stored fields such as faculty.displayName, faculty.emailAddress, subjectDescription, or courseTitle. When clients call the getFacultyMeetingTimes API, the server returns those values verbatim. The client-side rendering logic then writes the attacker-controlled strings into the page structure, triggering script execution in the victim's browser context.

The getFacultyMeetingTimes endpoint is reachable without authentication, which widens the victim pool to prospective students, parents, and the general public browsing course catalogs. Because the payload is stored server-side, every viewer of the affected course receives the malicious script until the data is sanitized.

Root Cause

The root cause is missing output encoding at the DOM insertion boundary. Faculty and course fields editable through the Banner ERP backend are treated as trusted content by the front-end rendering code, violating the principle of treating all user-controlled data as untrusted at the point of rendering.

Attack Vector

The attack requires Banner ERP write access for the initial injection step, but exploitation against end users requires no authentication. An attacker stores a payload such as a <script> tag or an event-handler attribute inside a course or faculty metadata field. When any user requests the course meeting times view, the script executes with the privileges of that user's browser session, enabling cookie theft, credential harvesting via injected forms, or pivoting to administrative functions if a staff member views the page.

No verified exploit code is published. See the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-47106

Indicators of Compromise

HTML or JavaScript control characters such as <script>, onerror=, or javascript: appearing in stored Banner fields like displayName, emailAddress, subjectDescription, or courseTitle.
Anomalous responses from the getFacultyMeetingTimes API containing script tags or encoded payloads.
Browser console errors or unexpected outbound requests originating from course meeting times pages.

Detection Strategies

Run database queries against Banner ERP tables to flag faculty and course metadata containing HTML tags, angle brackets, or JavaScript keywords.
Inspect HTTP responses from getFacultyMeetingTimes for HTML markup inside fields that should contain plain text.
Review web server and reverse proxy logs for unusual referrers or outbound calls from clients loading course search pages.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-source violations on Banner Self-Service domains.
Monitor Banner ERP audit logs for edits to faculty profile and course title fields by accounts that do not normally perform such updates.
Track changes to records returned by the public API and alert on the introduction of markup characters.

How to Mitigate CVE-2026-47106

Immediate Actions Required

Apply the Ellucian Banner Self-Service April T2 release (2025-04-23) or later, which addresses the missing HTML encoding.
Audit existing faculty and course records for stored payloads and sanitize any field containing HTML or script content.
Restrict and review Banner ERP write permissions, removing access from accounts that do not require it.

Patch Information

Ellucian addressed the issue in the Banner Self-Service April T2 release dated 2025-04-23. Institutions should consult the vendor's customer support portal and the Ellucian Security Researcher Hall of Fame for advisory references, and review the VulnCheck Advisory for impact details.

Workarounds

Deploy a Content Security Policy that disallows inline scripts on Banner Self-Service pages until patching is complete.
Place a web application firewall rule in front of getFacultyMeetingTimes to strip or block responses containing HTML tags inside text fields.
Temporarily revoke Banner ERP write access for non-essential accounts to limit the injection surface during the remediation window.

bash

# Configuration example
# Example CSP header to mitigate stored XSS exposure on Banner Self-Service
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report