What is the CVSS score of CVE-2026-47960?

CVE-2026-47960 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe ColdFusion are affected by CVE-2026-47960?

Adobe ColdFusion versions 2023.19, 2025.8, and earlier are vulnerable to remote, unauthenticated arbitrary file read attacks via malicious XML documents, enabling exfiltration of sensitive files,…

How to fix or mitigate CVE-2026-47960?

Within 24 hours: Inventory all ColdFusion deployments and identify systems running versions 2023.19, 2025.8, or earlier; document system location and sensitivity level. Within 7 days: Implement file upload restrictions blocking XML from untrusted sources; apply least-privilege filesystem permissions to ColdFusion process accounts; educate users to avoid opening untrusted documents in the application. Within 30 days: Establish continuous monitoring of Adobe security bulletins for patched versions; develop and test upgrade plans to versions confirmed to remediate CVE-2026-47960.

Adobe ColdFusion CVE-2026-47960

EUVD-2026-35831 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-09 psirt@adobe.com

GHSA-3mwf-3w9j-82vf

XXE Coldfusion

7.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:34 vuln.today

DescriptionCVE.org

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary file read in Adobe ColdFusion 2023.19, 2025.8 and earlier allows remote unauthenticated attackers to exfiltrate sensitive files from the host filesystem via a malicious XML document that a victim opens through the application. The scope-changed CVSS 7.4 reflects that exploitation can impact resources beyond ColdFusion's own security context, though success hinges on user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Adobe ColdFusion is a commercial Java-based application server and rapid web development platform widely used in enterprise and government environments for building dynamic web applications. CWE-611 (Improper Restriction of XML External Entity Reference) occurs when an XML parser processes input that defines external entities (e.g., SYSTEM identifiers referencing file:// URIs) without disabling DOCTYPE/external entity resolution. In ColdFusion's XML processing pipeline - used by tags and functions such as XmlParse, XmlSearch, and CFC SOAP/WSDL handling - an attacker can craft an XML payload that, when parsed, forces the underlying parser to dereference local files and return their contents inline or via out-of-band channels. The scope-change (S:C) in the CVSS vector indicates the entity resolution operates with privileges allowing access to resources outside the vulnerable component's normal authorization boundary, consistent with the JVM process reading arbitrary files on the host.

RemediationAI

Apply the vendor-released patches referenced in Adobe Security Bulletin APSB26-64 (https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html); the bulletin supersedes ColdFusion 2023 update 19 and 2025 update 8, so upgrade to the next cumulative update Adobe publishes against this bulletin and validate the post-install build number against the advisory. Until patching is complete, compensating controls include disabling DOCTYPE processing globally in the ColdFusion Administrator's XML settings where exposed, restricting which user roles can upload or submit XML-bearing content (CFM uploads, SOAP endpoints, WSDL parsers), and training operators not to open untrusted XML, CFM, or WSDL files in development tooling - accepting that disabling DOCTYPE may break legitimate integrations that rely on external schema resolution. Additionally, place ColdFusion behind a WAF rule that strips or rejects DOCTYPE declarations on inbound XML, and rotate any datasource passwords, administrator credentials, and signing keys stored on disk if the system has been internet-exposed prior to patching, as confidentiality impact assumes file read of secrets.