Executive brief
Adobe ColdFusion, a platform for building and deploying web applications, is affected by a security flaw that allows attackers to run malicious scripts in a user's browser. To succeed, an attacker must trick a user into clicking a specially crafted link. If successful, the attacker could gain unauthorized access to the user's session, steal sensitive information, or perform actions on the user's behalf within the application.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. The flaw is categorized as CWE-79, stemming from improper neutralization of user-supplied input during web page generation. An attacker can exploit this by sending a malicious link to a victim; when clicked, the script executes within the context of the victim's browser session. This can lead to session hijacking, unauthorized data access, or arbitrary code execution in the client-side environment. The CVSS vector indicates an adjacent network attack vector and requires user interaction.
Affected products
- Adobe ColdFusion 2025.9, 2023.20 and earlier
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory