CVE-2026-47960: Adobe ColdFusion XXE Vulnerability

CVE-2026-47960 Overview

CVE-2026-47960 is an XML External Entity (XXE) vulnerability affecting Adobe ColdFusion versions 2023.19, 2025.8, and earlier releases. The flaw stems from improper restriction of XML external entity references during XML parsing. An attacker can craft a malicious XML file that, when opened by a victim, forces the parser to resolve attacker-controlled external entities. Successful exploitation allows arbitrary file system reads outside the intended access scope, exposing sensitive files and directories. The vulnerability is classified under [CWE-611] and requires user interaction to trigger. Scope is changed, meaning the impact extends beyond the vulnerable component itself.

Critical Impact
Attackers can read arbitrary files from the underlying file system, including configuration files, credentials, and application source code, after a victim opens a malicious file.

Affected Products

Adobe ColdFusion 2023, version 2023.19 and earlier
Adobe ColdFusion 2025, version 2025.8 and earlier
Deployments parsing untrusted XML input via affected ColdFusion versions

Discovery Timeline

2026-06-09 - CVE-2026-47960 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47960

Vulnerability Analysis

The vulnerability resides in ColdFusion's XML parsing logic, which fails to disable resolution of external entities by default. When ColdFusion processes an attacker-supplied XML document, the parser dereferences SYSTEM or PUBLIC identifiers and retrieves content from local file paths or remote URLs. This behavior enables arbitrary file disclosure on the host running ColdFusion. Because the CVSS scope is changed, the disclosed data can include resources belonging to other security authorities beyond the ColdFusion process. Exploitation requires a user to open a malicious file, which makes phishing and document-based delivery the likely attack patterns. The flaw maps to [CWE-611], Improper Restriction of XML External Entity Reference.

Root Cause

ColdFusion's XML parser instantiates document builders without disabling external entity resolution or DTD processing. Secure defaults such as disallow-doctype-decl, external-general-entities, and external-parameter-entities are not enforced. Any XML payload reaching the parser can declare external entities that the parser dutifully resolves, leaking file contents into the parsed document tree.

Attack Vector

An attacker delivers a crafted XML or XML-bearing file to a ColdFusion operator or developer. When the victim opens the file with an affected ColdFusion component, the parser resolves an external entity such as file:///etc/passwd or a Windows configuration path. The resolved content is returned through the application response, error message, or out-of-band channel controlled by the attacker. The attack is network-reachable but requires user interaction to complete.

No verified public proof-of-concept code is available. See the Adobe ColdFusion Security Advisory for vendor technical details.

Detection Methods for CVE-2026-47960

Indicators of Compromise

XML files containing <!DOCTYPE declarations with SYSTEM or PUBLIC external entity references submitted to ColdFusion endpoints
ColdFusion process activity reading sensitive files such as /etc/passwd, /etc/shadow, or C:\Windows\win.ini shortly after XML processing
Outbound HTTP, FTP, or DNS requests from the ColdFusion JVM to attacker-controlled hosts following XML ingestion

Detection Strategies

Inspect XML inputs and uploads for DOCTYPE, ENTITY, or SYSTEM keywords using web application firewall rules
Correlate ColdFusion process file reads of sensitive paths with preceding XML parsing events
Alert on unexpected outbound network connections originating from the coldfusion or jrun Java process

Monitoring Recommendations

Enable verbose XML parsing and request logging on ColdFusion servers to capture suspicious payloads
Forward ColdFusion application and access logs to a centralized analytics platform for correlation
Monitor for anomalous file access patterns from the ColdFusion service account across endpoints and servers

How to Mitigate CVE-2026-47960

Immediate Actions Required

Apply the security updates referenced in Adobe Security Bulletin APSB26-64 to all ColdFusion 2023 and 2025 installations
Restrict which users can upload or open XML-bearing files within ColdFusion-driven workflows
Audit recent ColdFusion logs for XML payloads containing external entity declarations

Patch Information

Adobe has released fixed versions for the affected branches. Refer to the Adobe ColdFusion Security Advisory for the exact patched build numbers and download instructions. Upgrade ColdFusion 2023 beyond 2023.19 and ColdFusion 2025 beyond 2025.8.

Workarounds

Disable DTD processing and external entity resolution in custom CFML code that invokes XML parsers, using disallow-doctype-decl and disabling general and parameter entities
Place ColdFusion servers behind egress filtering to block outbound connections from the JVM to untrusted destinations
Sanitize and validate all XML input before passing it to ColdFusion functions such as XmlParse

bash

# Configuration example - disable DTDs in custom XML parsing
# In Java code invoked from ColdFusion:
# factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
# factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
# factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);