EUVD-2026-56544
GHSA-jcvr-p9r8-hcm4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerable fields appear restricted to a locally-accessible ColdFusion interface (AV:L); low-privilege account required (PR:L); separate victim browse mandatory (UI:R); no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
Technical ContextAI
Adobe ColdFusion is a commercial rapid web-application development platform and application server with a long enterprise install base. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled data written to one or more form fields is stored server-side and later re-rendered into HTML responses without adequate output encoding. CPE strings confirm both the 2023 (cpe:2.3:a:adobe:coldfusion_2023) and 2025 (cpe:2.3:a:adobe:coldfusion_2025) product lines are affected. The CVSS attack vector AV:L is notable: for a web application XSS this is atypical and suggests the vulnerable form fields reside in a locally-bound interface - likely the ColdFusion Administrator console, which is traditionally restricted to localhost - rather than a public-facing web endpoint. This localization is the primary factor constraining real-world attacker reach.
RemediationAI
Upgrade ColdFusion 2023 to update 2023.0.23 or ColdFusion 2025 to update 2025.0.12, both identified as the patched releases in EUVD-2026-56544 and Adobe APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html). If immediate patching is not feasible, restrict access to the ColdFusion Administrator interface to localhost or a dedicated management VLAN, reducing the set of accounts that can inject payloads into the vulnerable fields - note this does not remove the vulnerability but substantially narrows the attacker pool. Additionally, deploying a strict Content Security Policy (CSP) header with script-src limited to known origins can prevent injected scripts from executing even if a payload is stored, though CSP bypass techniques exist and this should not substitute for patching.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today