CVE-2022-38419: Adobe ColdFusion XXE allows arbitrary file system read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) with unauthenticated network reachability and very high EPSS, though no confirmed in-the-wild exploitation or KEV listing.

What it is

Adobe ColdFusion Update 14 and earlier and Update 4 and earlier are affected by an improper restriction of XML external entity (XXE) reference vulnerability. A remote, unauthenticated attacker can exploit it to read arbitrary files from the server file system. Because no user interaction is required, exposure is broad wherever the affected versions are reachable.

Impact

An attacker gains read access to arbitrary files on the ColdFusion host, which can expose configuration files, credentials and other sensitive data. Integrity and availability are not affected per the CVSS vector.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The specific vulnerable endpoint is not identified in the record.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.53028 (98.9th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the Adobe ColdFusion security update referenced in advisory APSB22-44 (Update 15 and Update 5 or later) as the primary fix.
• If patching cannot be done immediately, disable external entity processing in the XML parser configuration where the application allows it.
• Restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Run ColdFusion with least-privilege file system permissions to limit what an XXE read can reach.
• Monitor for unexpected outbound requests from the ColdFusion server that could indicate external entity resolution.

Detection

• Search ColdFusion and web server logs for XML payloads containing DOCTYPE, ENTITY or SYSTEM declarations in request bodies.
• Alert on outbound DNS or HTTP connections originating from the ColdFusion process to unexpected hosts.
• Monitor file access by the ColdFusion service account for reads of sensitive files such as configuration or credential stores.
• Correlate requests to ColdFusion endpoints with subsequent anomalous file reads or outbound callbacks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.