What is the CVSS score of EUVD-2026-35827?

EUVD-2026-35827 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe ColdFusion EUVD-2026-35827

| CVE-2026-47933 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-4wgh-wf35-gj87

XSS Coldfusion

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 17:37 NVD

5.4 (MEDIUM) 4.8 (MEDIUM)

CVSS changed

Jun 15, 2026 - 15:22 NVD

4.8 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 21:43 vuln.today

DescriptionNVD

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe ColdFusion (2023.x through 2023.19 and 2025.x through 2025.8) enables a low-privileged attacker on an adjacent network to inject persistent malicious JavaScript into vulnerable form fields. When a victim user browses to the page containing the stored payload, the script executes in their browser context, with scope change indicating impact can extend beyond the immediate ColdFusion application - such as session hijacking or unauthorized browser-side actions. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in source intelligence.

Technical ContextAI

Adobe ColdFusion is a commercial application server and rapid web development platform widely used in enterprise environments. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored/persistent variant, meaning attacker-supplied input is written to the server's data store without adequate sanitization and later rendered back into HTML responses served to other users. The CVSS attack vector AV:A (Adjacent Network) is technically significant: exploitation is constrained to attackers who share a network segment with the ColdFusion server, ruling out arbitrary internet-sourced attacks without prior network access. The changed scope indicator (S:C) reflects that injected scripts execute within the victim's browser - a security boundary distinct from the ColdFusion server itself - enabling cross-context impact such as cookie theft or DOM manipulation. No CPE strings were supplied in source data; affected products are identified from the CVE description and Adobe PSIRT advisory APSB26-64.

RemediationAI

Upgrade Adobe ColdFusion to a version beyond 2023.19 on the 2023 track or beyond 2025.8 on the 2025 track, per Adobe security bulletin APSB26-64 at https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html. The exact patched version numbers are not explicitly stated in the provided source data - consult the advisory directly for confirmed fix versions before upgrading. Where immediate patching is not feasible, restrict access to ColdFusion form-accepting endpoints to trusted network segments, which aligns with the adjacent-network attack vector constraint and reduces exposure surface. Deploying a Web Application Firewall with XSS-specific filtering rules can reduce injection success rates, though WAF rules may produce false positives on legitimate rich-text input and require tuning. Implementing a strict Content Security Policy (CSP) header on ColdFusion-served pages can limit the execution scope of any injected scripts by blocking inline script execution or restricting permitted script sources; note this may require application-level changes to existing inline JavaScript.