A reflected Cross‑Site Scripting flaw exists in ColdFusion versions 2025.9, 2023.20 and earlier. The flaw allows an attacker to inject malicious scripts into a page that is returned to a user. If the victim opens the crafted link, the injected code runs in their browser context, potentially granting the attacker the ability to execute arbitrary code with the victim’s privileges. The vulnerability escalates the scope of affected resources, increasing the potential impact on the system.

Adobe ColdFusion, versions 2025.9, 2023.20 and all earlier releases.

The CVSS score of 8.8 indicates a high severity, while the EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is web‑based and requires a user to open a malicious link; the vulnerability can be exploited remotely through normal web traffic.