CVE-2026-47933 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion affecting versions 2023.0.0 through 2023.19 and 2025.0.0 through 2025.8. The vulnerability allows a low-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser, potentially leading to script execution. The affected component is limited to an administrative network zone by default, which changes the scope of the impact. The CVSS 3.1 base score is 4.8, reflecting a medium severity with attack vector as adjacent network, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed by Adobe as of the publication date.

Successful exploitation could allow an attacker with low privileges to execute arbitrary JavaScript in the context of users accessing the vulnerable administrative interface, potentially leading to information disclosure or session hijacking. The impact is limited by the default restriction of the vulnerable component to an administrative network zone, reducing exposure to external attackers. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Restricting access to the administrative network zone and limiting user privileges can help reduce risk until a patch is available.