CVE-2026-48320 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion 2025. It enables attackers to inject malicious scripts into web pages viewed by victims, potentially compromising confidentiality and integrity by gaining elevated access or control over user accounts or sessions. Exploitation requires user interaction, such as opening a malicious file. The vulnerability affects the scope of the system and is rated high severity with a CVSS 3.1 score of 8.5 (Attack Vector: Adjacent, Low Complexity, No Privileges Required, Requires User Interaction, Scope Changed, High Confidentiality and Integrity impact, No Availability impact). No vendor advisory or patch information is currently available.

Successful exploitation can lead to the attacker executing malicious scripts in the context of the victim's browser session, potentially resulting in elevated access or control over the victim's account or session data. The confidentiality and integrity of the affected system can be compromised. Availability is not impacted. The attack requires user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering the reflected XSS vulnerability. Monitor Adobe's security advisories for updates and apply patches promptly once released.