Executive brief
Adobe ColdFusion, a widely-used web application server for building dynamic websites and cloud services, is vulnerable to reflected cross-site scripting (XSS). An attacker could craft a malicious link or file that, when opened by a victim, injects harmful scripts into their browser session, potentially allowing unauthorized access to sensitive account data or session hijacking.
Technical details
The vulnerability is a reflected XSS flaw in ColdFusion that allows injection of malicious scripts into web pages through unsanitized user input. Exploitation requires user interaction—specifically, a victim must click a malicious link or open a crafted file. The XSS can occur across a changed scope, meaning the attack may affect different security boundaries than initially expected. Once executed in a victim's browser, the injected script gains access to session tokens or account credentials, enabling account compromise or elevated privilege actions.
Affected products
- Adobe ColdFusion
Timeline
- 2026-09-08: disclosed