HIGH CWE-79
CVE-2026-48307
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe·ColdFusion 2025
8.8/ 10
CVSS 3.1
High severity
0.55%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 47% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Jun 30, 2026
- Updated
- Aug 27, 2026
- First covered
- Jul 3, 2026
- Latest story
- 4 months ago
Summary
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.
CWE-79Cross-site Scripting (Reflected XSS) (CWE-79)
Attack profile
Attack vectorAdjacent
ComplexityLow
PrivilegesNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HAffected products
- Adobe ColdFusion 2025up to 9
- Adobe ColdFusion 2023up to 20