CVE-2026-47960

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier

Description An Improper Restriction of XML External Entity Reference (XXE) allows arbitrary file system read. This issue enables an attacker to access sensitive files and directories outside the intended access scope. Exploitation requires user interaction, specifically that a victim opens a malicious file. XXE is a type of attack where an application processes XML input containing a reference to an external entity, which can be used to disclose internal files.

Recommendations Update ColdFusion versions 2023.19 and earlier to a patched version. Update ColdFusion versions 2025.8 and earlier to a patched version.