Adobe ColdFusion Reflected Cross-Site Scripting Vulnerability

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Adobe ColdFusion versions 2025.2, 2023.14, and 2021.20 and earlier. This vulnerability allows an unauthenticated attacker to execute malicious JavaScript in the context of the victim's browser, but only if the victim is convinced to visit a URL that references a vulnerable page. The issue is restricted to internal IP addresses.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the victim's browser.

Remediation

Users are advised to update to ColdFusion 2025 Update 3, ColdFusion 2023 Update 15, or ColdFusion 2021 Update 21. For more information on applying these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-69.