CVE-2016-4264

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

• CWE-611

• http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txtExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539374/100/0/threaded
• http://www.securityfocus.com/bid/92684
• http://www.securitytracker.com/id/1036708
• https://helpx.adobe.com/security/products/coldfusion/apsb16-30.htmlVendor Advisory
• https://www.exploit-db.com/exploits/40346/
• http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txtExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539374/100/0/threaded
• http://www.securityfocus.com/bid/92684
• http://www.securitytracker.com/id/1036708
• https://helpx.adobe.com/security/products/coldfusion/apsb16-30.htmlVendor Advisory
• https://www.exploit-db.com/exploits/40346/

Published

Sep 1, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4258Adobe Digital Editions before 4.5.2 allows attackers to exec…
• CVE-2016-4259Adobe Digital Editions before 4.5.2 allows attackers to exec…
• CVE-2016-4260Adobe Digital Editions before 4.5.2 allows attackers to exec…
• CVE-2016-4261Adobe Digital Editions before 4.5.2 allows attackers to exec…
• CVE-2016-4262Adobe Digital Editions before 4.5.2 allows attackers to exec…
• CVE-2016-4263Use-after-free vulnerability in Adobe Digital Editions befor…
• CVE-2016-4265Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…
• CVE-2016-4266Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…
• CVE-2016-4267Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…
• CVE-2016-4268Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…
• CVE-2016-4269Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…
• CVE-2016-4270Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat…