cbcvebase.
CVE-2026-76002
published 2026-09-08

CVE-2026-76002: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a…

PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.43%
35.9th percentile
ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

Affected

39 ranges· showing 25
VendorProductVersion rangeFixed in
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.