CVE-2022-28818: Adobe ColdFusion reflected XSS in vulnerable pages

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 6.1 medium severity with required user interaction, but high EPSS and a network-reachable unauthenticated vector warrant prompt patching.

What it is

Adobe ColdFusion CF2021U3 and earlier and CF2018U13 contain a reflected cross-site scripting flaw in a vulnerable page. An attacker who gets a victim to open a crafted URL can run JavaScript in the victim's browser in the context of the ColdFusion site. This matters because it can be used for session theft or actions performed as the victim against the affected application.

Impact

An attacker can execute arbitrary JavaScript in the victim's browser session, enabling theft of session data or other client-side actions within the ColdFusion application's origin.

Attack surface

Reached over the network through a crafted URL referencing a vulnerable ColdFusion page; no authentication is required, but the victim must be convinced to visit the link (user interaction required).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is high at 0.44841 (98.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Adobe ColdFusion security update in APSB22-22 (upgrade to CF2021U4 or later, or CF2018U14 or later).
• If immediate patching is not possible, restrict network access to ColdFusion administrative and application endpoints and review exposed pages.
• Deploy a WAF or input filtering to block reflected script payloads on ColdFusion request parameters.
• Set HttpOnly and Secure flags on session cookies and enforce a Content Security Policy to limit script execution.
• Review ColdFusion server logs for suspicious encoded script strings in request URLs.

Detection

• Search web and proxy logs for requests containing script tags, event handlers, or encoded JavaScript in query strings to ColdFusion pages.
• Monitor for outbound or inline script execution anomalies tied to ColdFusion responses.
• Alert on repeated requests from a single source probing ColdFusion endpoints with XSS-like payloads.
• Correlate suspicious URL patterns with subsequent session cookie reuse or unusual authenticated actions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.