CVE-2026-47933: ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. The vulnerable component is restricted to an administrative network zone by default. Scope is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ColdFusionto a version that resolves this vulnerability.Fixed in 2023.19 - Upgrade
Upgrade
ColdFusionto a version that resolves this vulnerability.Fixed in 2025.8 - Compensating control
Restrict access to the vulnerable ColdFusion component (the stored-XSS vulnerable form field) to an administrative network zone (it is restricted by default per the material).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47933?
CVE-2026-47933 has a severity rating of medium with a score of 4.8.
How do I fix CVE-2026-47933?
To fix CVE-2026-47933, upgrade to a patched version of Adobe ColdFusion that addresses the stored XSS vulnerability.
What systems are affected by CVE-2026-47933?
CVE-2026-47933 affects Adobe ColdFusion versions 2023.19, 2025.8, and earlier.
What type of vulnerability is CVE-2026-47933?
CVE-2026-47933 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79.
Who can exploit CVE-2026-47933?
CVE-2026-47933 can be exploited by low-privileged attackers who are able to inject malicious scripts into vulnerable form fields.