A reflected cross‑site scripting vulnerability exists in Adobe ColdFusion 2023 and 2025. The flaw allows attackers to inject malicious scripts into pages displayed to users, potentially gaining elevated access or control over the victim’s account or session. The vulnerable component is restricted to an administrative network zone by default, and exploitation requires user interaction; a victim must open a malicious file. Scope is changed due to the escalation potential.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. Patched or newer releases are not listed, so any installation of the mentioned versions is vulnerable.

The CVSS score of 8.5 indicates high severity while the EPSS score of 5% indicates a lower likelihood of exploitation. The vulnerable component is restricted to an administrative network zone by default. It is not listed in the CISA KEV catalog, so no known public exploitation campaigns have been reported. The vulnerability requires user interaction – the victim must open a malicious file – which limits the attack vector to social engineering or phishing, and it also changes scope, potentially affecting higher‑privileged resources. Once activated, the attacker may execute arbitrary script in the victim’s browser context, potentially elevating privileges within the application.