Skip to content
OpenAdvisories
High WID-SEC-2026-1858 7 CVEs

Adobe ColdFusion: Mehrere Schwachstellen

Published Jun 9, 2026 · Updated Jun 9, 2026 · de-DE

Vendor: Adobe Product: ColdFusion Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, sensible Daten offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.

Vulnerabilities 7

  • Critical 9.6
    CVE-2026-47928

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zo…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 8.8
    CVE-2026-47932

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 8.4
    CVE-2026-47929

    ColdFusion | Incorrect Authorization (CWE-863)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elev…

    Adobe ColdFusion 2025 ColdFusion 2023
  • High 8.4
    CVE-2026-47931

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to e…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 8.1
    CVE-2026-47930

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unautho…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 7.4
    CVE-2026-47960

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive file…

    Adobe ColdFusion 2025 ColdFusion 2023
  • Medium 4.8
    CVE-2026-47933

    ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

    ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed i…

    Adobe ColdFusion 2025 ColdFusion 2023

Revision history

  1. #1

    Initiale Fassung

References