CVE-2026-48320
HighCVSS 8.5Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious scripts into a web page, potentially leading to session or account takeover. Exploitation requires user interaction, such as opening a malicious file.
Risk Assessment
The risk for the organization includes potential session hijacking, account takeover, and leakage of sensitive data. The attack can be carried out through social engineering, e.g., by sending a crafted file.
Recommendation
It is recommended to immediately update ColdFusion to the latest patched version. Additionally, implement input validation and output encoding mechanisms in web applications.
Original NVD description (English source)
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.