CVE-2026-47960: ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Synopsis

An XML External Entity (XXE) injection vulnerability affects Adobe ColdFusion versions 2025.8 and earlier (including 2023.19 and earlier). The vulnerability is reachable over the network without authentication, but requires a victim to open a malicious file, and it carries a changed scope indicator meaning impact can extend beyond the vulnerable component itself. Successful exploitation gives an attacker arbitrary read access to files and directories on the underlying file system. No fix versions have been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Adobe ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ColdFusion service must be reachable over the network for an attacker to deliver a malicious XML payload.

• AuthenticationNot required

  No credentials or account privileges are needed to attempt exploitation.

• Victim interactionRequired

  A user with access to the ColdFusion instance must open or process a malicious file supplied by the attacker.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• Reads arbitrary files from the ColdFusion server file system, including configuration files that may contain database credentials, API keys, or other secrets.
• Traverses directories outside the application root, potentially exposing OS-level files such as /etc/passwd or Windows system configuration.
• Because scope is changed, the file-read capability can extend to resources belonging to components beyond the directly vulnerable ColdFusion process.