CVE-2026-47933 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion affecting versions 2023.0.0 through 2023.19 and 2025.0.0 through 2025.8. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the context of users' browsers when they access the affected pages. The vulnerability impacts confidentiality and integrity with no availability impact. The CVSS 3.1 base score is 4.8 (medium severity), reflecting an attack vector over the network with low complexity and requiring user interaction. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users visiting the affected ColdFusion pages. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of web content within the user's session context. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable forms and applying input validation or sanitization controls where possible to reduce the risk of script injection.