CVE-2026-48307

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier

Description A reflected Cross-Site Scripting (XSS) issue allows an attacker to inject malicious scripts into a web page. This could lead to arbitrary code execution within the context of the current user. Successful exploitation requires user interaction, specifically that the victim opens a malicious link.

Recommendations Update ColdFusion to a version later than 2025.9.