CVE-2026-76002 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe ColdFusion 2025. An attacker can exploit this by convincing a user to visit a specially crafted URL, causing malicious JavaScript to execute within the victim's browser context. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating some impact beyond the vulnerable component. No known exploits are reported in the wild, and no patch or official remediation level has been disclosed by Adobe as of the publication date.

Successful exploitation can lead to execution of arbitrary JavaScript in the victim's browser, potentially allowing theft of sensitive information or session hijacking within the affected web application context. The CVSS score of 6.1 reflects a medium severity impact on confidentiality and integrity, with no impact on availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying standard XSS mitigations such as input validation and output encoding on affected pages. Monitor Adobe's advisories for updates on patches or official mitigations.