EUVD-2026-44554
GHSA-gvvg-xf8x-hr96
Severity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Reflected XSS is inherently network-delivered; AV:N better reflects internet-accessible ColdFusion deployments than AV:A, though official vector disagrees.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
11DescriptionNVD
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) enables unauthenticated adjacent-network attackers to inject malicious scripts into a victim's browser session, achieving high-severity confidentiality and integrity impact through session hijacking or account takeover. Exploitation requires user interaction - a victim must open a malicious file - and CVSS scope change (S:C) reflects that the impact crosses from the ColdFusion server context into the victim's browser environment. EPSS sits at 3.75% raw probability but at the 89th percentile, indicating elevated relative risk among all CVEs; however, SSVC rates exploitation as 'none' and the vulnerability is not listed in CISA KEV, so no public exploit identified at time of analysis.
Technical ContextAI
Adobe ColdFusion is an enterprise application server and CFML-based rapid development platform used primarily in corporate, government, and financial environments. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS), meaning user-controlled input is reflected back in an HTTP response without adequate sanitization or encoding, allowing injected JavaScript to execute in a victim's browser. The affected CPE strings confirm Adobe ColdFusion 2023 base release through Update 17 (cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:* through update17), and EUVD data extends this to all 2023 releases up to and including Update 21. ColdFusion 2025 Updates 1 through 10 are also confirmed affected per EUVD-2026-44554. The CVSS vector AV:A (Adjacent) suggests the ColdFusion endpoint may be reachable only within a network segment rather than the open internet, which partially constrains the attack surface.
RemediationAI
Apply vendor-released patches immediately: upgrade ColdFusion 2023 to Update 22 and ColdFusion 2025 to Update 11, as documented in Adobe security bulletin APSB26-82 at https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html. If immediate patching is not feasible, restrict network access to the ColdFusion server so it is not reachable from untrusted adjacent segments, which directly addresses the AV:A attack vector. Additionally, deploy a Web Application Firewall (WAF) with XSS filtering rules in blocking mode in front of ColdFusion endpoints to detect and drop reflected XSS payloads; note this is a compensating control only and may produce false positives on legitimate complex query parameters. User awareness training to avoid opening unexpected files or links is a secondary mitigation given the UI:R requirement. ColdFusion 2021 and earlier release lines should be treated as potentially affected until Adobe confirms otherwise.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today