CVE-2016-4264

8.6 highEPSS 69%

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Severity

CVSS 3.0

8.6 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 69% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2016-09-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

adobe:coldfusion

References

http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt
http://www.securityfocus.com/archive/1/539374/100/0/threaded
http://www.securityfocus.com/bid/92684
http://www.securitytracker.com/id/1036708
https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html

Check your stack JSON