CVE-2026-75993: Cross-site Scripting (Reflected XSS) (CWE-79) in Adobe ColdFusion 2025

CVE-2026-75993 describes a reflected Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion 2025. An attacker can exploit this flaw by tricking a user into opening a malicious file, which results in the injection of malicious scripts into web pages served by ColdFusion. This can lead to elevated privileges or session control for the attacker. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity, with attack vector requiring adjacent network access, low attack complexity, no privileges required, user interaction required, and a changed scope. Confidentiality and integrity impacts are high, while availability is not affected.

Successful exploitation can lead to an attacker executing arbitrary scripts in the context of the victim's browser session, potentially allowing the attacker to hijack user sessions, steal sensitive information, or perform actions on behalf of the victim. The vulnerability affects confidentiality and integrity with high impact, but does not affect availability.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted files and avoid opening suspicious files that could trigger the vulnerability.