CVE-2026-75993 Overview
Adobe ColdFusion contains a reflected Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75993. An attacker can inject malicious scripts into a web page rendered by ColdFusion. Successful exploitation can lead to elevated access or takeover of the victim's account or session. Exploitation requires user interaction: the victim must open a malicious file. The issue carries a changed scope, meaning the injected script can affect resources beyond the vulnerable component. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers who convince a user to open a crafted file can execute script in the victim's browser context and hijack authenticated ColdFusion sessions.
Affected Products
- Adobe ColdFusion (see Adobe ColdFusion Security Advisory APSB26-119 for affected versions)
Discovery Timeline
- 2026-09-08 - CVE-2026-75993 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-75993
Vulnerability Analysis
The flaw is a reflected XSS in Adobe ColdFusion. User-supplied input is echoed back into a response without proper output encoding or sanitization. When a victim opens a crafted file that triggers a request to a vulnerable ColdFusion endpoint, the server reflects attacker-controlled script into the rendered page. The browser then executes that script under the origin of the ColdFusion application.
Because the CVSS scope is changed, script execution can reach resources beyond the initially vulnerable component. Impact to confidentiality and integrity is high, while availability is not directly affected. The attack vector is adjacent network, meaning the attacker must be on a logically adjacent network segment to reach the vulnerable service.
Root Cause
The root cause is improper neutralization of user input during web page generation [CWE-79]. Input reaching a response-rendering path is not encoded for the HTML context, allowing script tags or event handlers to execute in the victim's browser.
Attack Vector
An attacker crafts a malicious file, such as an HTML document or shortcut, that issues a request to a vulnerable ColdFusion endpoint with a script payload in a reflected parameter. The victim opens the file from the adjacent network position. ColdFusion returns a page containing the attacker's script, which executes and can exfiltrate session tokens, perform actions as the victim, or pivot to other application resources within the changed scope.
Refer to the Adobe ColdFusion Security Advisory APSB26-119 for vendor technical details.
Detection Methods for CVE-2026-75993
Indicators of Compromise
- HTTP requests to ColdFusion endpoints containing script tags, javascript: URIs, or common XSS payload markers such as onerror=, onload=, or <svg/onload> in query parameters.
- Reflected responses from ColdFusion applications that include unencoded user-supplied input inside HTML, attribute, or script contexts.
- Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after visiting ColdFusion pages.
Detection Strategies
- Inspect web server and application logs for parameters containing HTML control characters (<, >, ", ') that are echoed into responses.
- Deploy WAF rules aligned to OWASP CRS XSS signatures in front of ColdFusion applications.
- Correlate file-open telemetry from endpoints with subsequent HTTP requests to internal ColdFusion hosts to identify social-engineering-driven exploitation.
Monitoring Recommendations
- Monitor ColdFusion access logs for anomalous query strings and unusual referrers pointing to local files (file://).
- Track browser process trees for child processes spawned from Office, PDF, or mail clients that immediately connect to internal ColdFusion services.
- Alert on session token reuse from unexpected IP addresses following ColdFusion page views.
How to Mitigate CVE-2026-75993
Immediate Actions Required
- Apply the Adobe security update referenced in APSB26-119 to all ColdFusion instances.
- Restrict adjacent network access to ColdFusion management and application interfaces using network segmentation and firewall rules.
- Warn users against opening unsolicited files, particularly HTML documents or shortcuts, that could trigger requests to internal applications.
Patch Information
Adobe has published security guidance in APSB26-119. Administrators should identify affected ColdFusion versions in their environment and apply the vendor-supplied update following Adobe's installation instructions.
Workarounds
- Enable and enforce a strict Content Security Policy (CSP) on ColdFusion applications to limit inline script execution.
- Configure HTTP-only and Secure flags on session cookies to reduce the impact of session token theft.
- Deploy a web application firewall with XSS signatures in blocking mode for ColdFusion endpoints until patching completes.
# Example CSP header configuration for ColdFusion responses
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
