Ongoing since 08:07 PM UTC.
October 27, 2026 Ellucian is aware of the recently disclosed security vulnerability CVE-2026-111497, commonly referred to as Node2Shell or HTTP2Shell, which affects the Brotli decompression library used by Node.js and other software components. We recognize the potential seriousness of this vulnerability and are actively assessing its impact across our products, services, and supporting infrastructure. Our response includes: - Impact assessment: Identifying potentially affected products, runtimes, libraries, and third-party dependencies. - Remediation: Prioritizing available security patches and appropriate mitigations for affected components. - Ongoing validation: Reviewing additional exposure as vendors and security researchers identify new affected software and exploitation techniques. - Customer guidance: Determining whether customer-managed environments require updates or additional action. Because this vulnerability affects a widely used software component, the full scope of potentially impacted products continues to evolve. Our investigation and remediation activities are ongoing. We will provide additional updates, including product-specific remediation guidance where applicable, as information becomes available. Customer action - Managed Cloud/SaaS customers: No action is required at this time. Ellucian is managing assessment and remediation activities for Ellucian-hosted environments. - On-premise customers: -- As a reminder, Ellucian strongly recommends that customers remain on supported software versions and apply upgrades and security patches promptly. -- Ellucian distributes security notifications via email (that are also viewable as Customer Center publications). Emails come from: [email protected] and are sent to the Primary Account Contact and Technical Security Contact on file.
Update timeline
- investigating Oct 27, 2026, 08:07 PM UTC
October 27, 2026 Ellucian is aware of the recently disclosed security vulnerability CVE-2026-111497, commonly referred to as Node2Shell or HTTP2Shell, which affects the Brotli decompression library used by Node.js and other software components. We recognize the potential seriousness of this vulnerability and are actively assessing its impact across our products, services, and supporting infrastructure. Our response includes: - Impact assessment: Identifying potentially affected products, runtimes, libraries, and third-party dependencies. - Remediation: Prioritizing available security patches and appropriate mitigations for affected components. - Ongoing validation: Reviewing additional exposure as vendors and security researchers identify new affected software and exploitation techniques. - Customer guidance: Determining whether customer-managed environments require updates or additional action. Because this vulnerability affects a widely used software component, the full scope of potentially impacted products continues to evolve. Our investigation and remediation activities are ongoing. We will provide additional updates, including product-specific remediation guidance where applicable, as information becomes available. Customer action - Managed Cloud/SaaS customers: No action is required at this time. Ellucian is managing assessment and remediation activities for Ellucian-hosted environments. - On-premise customers: -- As a reminder, Ellucian strongly recommends that customers remain on supported software versions and apply upgrades and security patches promptly. -- Ellucian distributes security notifications via email (that are also viewable as Customer Center publications). Emails come from: [email protected] and are sent to the Primary Account Contact and Technical Security Contact on file.
Your product runs on more than Ellucian
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services