CVE-2026-71386
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Cross-site Scripting (XSS) vulnerability in ColdFusion that could result in arbitrary code execution in the context of the current user. Requires user interaction (opening a malicious file). Scope is changed.
Risk Assessment
An attacker can execute scripts in the victim's context, potentially leading to data theft or session hijacking.
Recommendation
Apply security patches provided by the ColdFusion vendor.
Original NVD description (English source)
is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.