CVE-2026-21269: ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-21269?
CVE-2026-21269 has a medium severity rating of 4.6.
How do I fix CVE-2026-21269?
To fix CVE-2026-21269, update to the latest version of ColdFusion that addresses the stored XSS vulnerability.
What type of vulnerability is CVE-2026-21269?
CVE-2026-21269 is a stored Cross-Site Scripting (XSS) vulnerability.
Who can exploit CVE-2026-21269?
A low-privileged attacker can exploit CVE-2026-21269 to inject malicious scripts into vulnerable form fields.
What can happen if CVE-2026-21269 is exploited?
If CVE-2026-21269 is exploited, malicious JavaScript may execute in a victim's browser when they visit the affected page.