Adobe ColdFusion Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe ColdFusion versions 2025.2, 2023.14, and 2021.20 and earlier. This vulnerability allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the page containing the compromised field, the injected JavaScript could be executed in their browser, potentially leading to a change in scope. The issue is limited to internal IP addresses.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the victim's browser.

Remediation

Users are advised to update to ColdFusion 2025 Update 3, ColdFusion 2023 Update 15, or ColdFusion 2021 Update 21. For instructions on how to update, refer to the Adobe ColdFusion downloads page or the respective ColdFusion update tech notes. Additionally, review the ColdFusion Lockdown Guides for security configuration recommendations.