CVE-2026-76002: ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
Published Sep 8, 2026
·Updated
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Affected Software
1 affected component
Adobe ColdFusion
Event History
Sep 8, 2026
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker must convince a victim to visit a URL that references a vulnerable page. No attacker privileges are required, but victim interaction is required.
2
What is the likely impact if exploitation succeeds?
Malicious JavaScript can execute in the victim's browser in the context of the affected site. The provided vector indicates potential confidentiality and integrity impact, with no availability impact.