Adobe ColdFusion CVE-2026-21269

A low-privileged ColdFusion account with write access to the vulnerable form field is required - the CVSS PR:L metric confirms unauthenticated exploitation is not possible. A separate victim must actively browse to the page rendering the injected content (UI:R), making this a two-stage attack that cannot be automated end-to-end. The CVSS AV:L rating indicates the injection point is likely accessible only through a locally-bound interface (probable ColdFusion Administrator, traditionally restricted to localhost or a management network), meaning network-remote unauthenticated attackers cannot reach the injection surface at all. Exploitation is further limited by the non-default requirement for a valid low-privileged credential and local or management-network access - the SSVC automatable:no flag confirms mass exploitation is not feasible under current conditions.

The assigned CVSS score of 4.6 (Medium) reflects several limiting factors: local attack vector (AV:L), requirement for a low-privileged account (PR:L), and mandatory victim interaction (UI:R). The AV:L rating presents a meaningful discrepancy from typical stored XSS behavior - if the vulnerable fields were on a network-reachable endpoint, AV:N would apply and the real-world risk would be materially higher; defenders should confirm with the Adobe APSB26-90 advisory whether the vulnerable surface is exclusively the localhost-bound administrator interface. The scope change (S:C) partially offsets the low base score by indicating cross-user impact. SSVC's automatable:no designation and partial technical impact are consistent with a targeted, non-wormable attack requiring manual exploitation steps. No EPSS data was supplied. The overall posture is real but bounded: the primary concern is a malicious insider or a compromised low-privilege account leveraging admin-facing pages to target higher-privileged users. This is not a fire-drill priority but warrants timely patching.

An attacker with a low-privileged ColdFusion account accesses the administrator or application interface locally and submits a crafted payload such as a script tag that exfiltrates session cookies into a vulnerable form field, which ColdFusion persists without sanitization. When an administrator or another authenticated user subsequently browses to the page containing the injected content, the script executes in their browser, potentially stealing session tokens or performing actions on their behalf. No public exploit code has been identified, but the stored XSS technique is well-documented and reproducible by any attacker with basic web exploitation knowledge.