CVE-2026-75993 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion 2025. An attacker can exploit this flaw by tricking a user into opening a malicious file, which causes malicious scripts to be injected into web pages viewed by the victim. This can result in elevated privileges or control over the victim's session or account. The vulnerability is characterized by a CVSS 3.1 score of 8.5, indicating high impact on confidentiality and integrity with no impact on availability. The attack vector requires adjacent network access and user interaction. No official patch or remediation level has been published yet.

Successful exploitation can lead to high confidentiality and integrity impact by allowing attackers to execute malicious scripts in the context of the victim's session, potentially leading to account compromise or unauthorized actions. Availability is not affected. The attack requires user interaction and adjacent network access, limiting the attack surface somewhat but still posing a significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with files received from untrusted sources to prevent exploitation via malicious file opening. Monitor Adobe's advisories for updates on patches or mitigations.