CVE-2026-47933 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion affecting versions 2023.19, 2025.8, and earlier. A low-privileged attacker can exploit this vulnerability by injecting malicious JavaScript into vulnerable form fields. When a victim accesses the page containing the injected script, the malicious code executes in their browser, potentially leading to information disclosure or session hijacking. The vulnerability scope is changed, indicating a broader impact than initially scoped. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, and user interaction, with a scope change and limited confidentiality and integrity impact but no availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users who view the affected form fields. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on system availability. The vulnerability affects the confidentiality and integrity of data processed by the affected ColdFusion instances.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and output encoding on form fields to mitigate stored XSS risks. Monitor Adobe's security advisories for updates on patches or official mitigations.