CVE-2026-48307

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.

• CWE-79

• https://helpx.adobe.com/security/products/coldfusion/apsb26-68.htmlVendor Advisory

Published

Jun 30, 2026

Last Modified

Jul 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48301Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 a…5.4
• CVE-2026-48302CAI Content Credentials is affected by an Improper Input Val…6.2
• CVE-2026-48303Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and e…10
• CVE-2026-48304Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 a…5.4
• CVE-2026-48305Substance3D - Sampler versions 6.0.0 and earlier are affecte…7.8
• CVE-2026-48306Substance3D - Sampler versions 6.0.0 and earlier are affecte…7.8
• CVE-2026-48308Premiere Pro is affected by an Improper Input Validation vul…5.9
• CVE-2026-48309Audition is affected by an out-of-bounds write vulnerability…7.8
• CVE-2026-4831A security flaw has been discovered in kalcaddle kodbox 1.64…3.7
• CVE-2026-48310Adobe Experience Manager is affected by an Improper Limitati…8.6
• CVE-2026-48311Bridge is affected by an out-of-bounds write vulnerability t…7.8
• CVE-2026-48312CAI Content Credentials is affected by an Improper Input Val…6.8