CVE-2026-76002: ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
Published Sep 8, 2026
·Updated
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Affected Software
38 affected components
Adobe ColdFusion
Adobe ColdFusion=2023
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update13
Adobe ColdFusion=2023-update14
Adobe ColdFusion=2023-update15
Adobe ColdFusion=2023-update16
Adobe ColdFusion=2023-update17
Adobe ColdFusion=2023-update18
Adobe ColdFusion=2023-update19
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update20
Adobe ColdFusion=2023-update21
Adobe ColdFusion=2023-update22
Adobe ColdFusion=2023-update23
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025
Adobe ColdFusion=2025-update1
Adobe ColdFusion=2025-update10
Adobe ColdFusion=2025-update11
Adobe ColdFusion=2025-update12
Adobe ColdFusion=2025-update2
Adobe ColdFusion=2025-update3
Adobe ColdFusion=2025-update4
Adobe ColdFusion=2025-update5
Adobe ColdFusion=2025-update6
Adobe ColdFusion=2025-update7
Adobe ColdFusion=2025-update8
Adobe ColdFusion=2025-update9
Event History
Sep 8, 2026
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker must convince a victim to visit a URL that references a vulnerable page. No attacker privileges are required, but victim interaction is required.
2
What is the likely impact if exploitation succeeds?
Malicious JavaScript can execute in the victim's browser in the context of the affected site. The provided vector indicates potential confidentiality and integrity impact, with no availability impact.