CVE-2026-47960 is an XXE vulnerability in Adobe ColdFusion that affects versions 2023.0.0 to 2023.19 and 2025.0.0 to 2025.8. The vulnerability arises from improper restriction of XML external entity references, enabling an attacker to read arbitrary files on the file system outside the intended access scope. Exploitation requires user interaction, as the victim must open a crafted malicious file. The vulnerability has a CVSS v3.1 score of 7.4, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and a scope change with high confidentiality impact.

Successful exploitation allows an attacker to read sensitive files and directories on the affected system, potentially exposing confidential information. There is no impact on integrity or availability. The attack requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Adobe's advisories for updates. Until a patch is available, avoid opening untrusted files and consider applying any recommended temporary mitigations from Adobe once published.