CVE-2016-4264: Adobe ColdFusion OOXML XXE allows arbitrary file read and SSRF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote XXE with public exploit code and very high EPSS, but no KEV listing and impact limited to confidentiality and SSRF rather than code execution.

What it is

Adobe ColdFusion 10 (before Update 21) and 11 (before Update 10) mishandle XML external entity declarations in crafted OOXML spreadsheets processed by the OOXML feature. Because the parser resolves external entities, an attacker can read arbitrary files or force the server to make TCP requests to intranet hosts. The flaw is remotely reachable without authentication, making it a serious exposure for internet-facing ColdFusion instances.

Impact

An attacker gains read access to files on the ColdFusion server and can use the server as a proxy to reach internal network services. This can expose credentials, configuration and source code, and enable reconnaissance or lateral movement against intranet systems.

Attack surface

Reached remotely over the network by submitting a crafted OOXML spreadsheet to the affected OOXML processing feature; the CVSS vector shows no privileges and no user interaction required. No authentication is needed per the vector (PR:N, UI:N).

Exploitation

Public exploit code is referenced (Exploit-DB 40346 and a Legal Hackers advisory tagged Exploit), and EPSS is very high at 0.69 (99.3rd percentile), though the CVE is not listed in CISA KEV. This indicates active interest and easy weaponization rather than confirmed widespread exploitation.

What to do

• Upgrade ColdFusion 10 to Update 21 or later and ColdFusion 11 to Update 10 or later per Adobe advisory APSB16-30.
• Disable or restrict the OOXML spreadsheet processing feature if it is not required.
• Configure the XML parser to disallow external entity resolution and DTD processing for OOXML input.
• Restrict outbound network access from the ColdFusion server to internal hosts to limit SSRF reach.
• If patching is delayed, place the instance behind a WAF or reverse proxy that blocks XXE payloads in uploaded spreadsheets.

Detection

• Monitor ColdFusion logs and HTTP requests for OOXML/spreadsheet uploads containing DOCTYPE or ENTITY declarations.
• Alert on unexpected outbound TCP connections from the ColdFusion server to internal addresses or unusual ports.
• Watch for file read patterns or errors referencing system files (for example /etc/passwd, web.config) in ColdFusion error logs.
• Use file integrity monitoring on ColdFusion configuration and web root directories for unexpected reads or changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.