CVE-2016-4264 The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrar

What is CVE-2016-4264?

CVE-2016-4264 is a high-severity vulnerability in Adobe Coldfusion, published on 1 Sep 2016.

Official description

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Weakness: CWE-611

Which versions are affected by CVE-2016-4264?

It affects 1 product.

Products include Adobe Coldfusion.

How do I fix CVE-2016-4264?

No fix has been published for CVE-2016-4264 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-4264 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-4264 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Adobe Coldfusion

• CVE-2026-48282 Adobe ColdFusion Path Traversal Exploited Critical 10.0
• CVE-2023-38203 Adobe ColdFusion Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2023-29300 Adobe ColdFusion Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2023-26359 Adobe ColdFusion Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2018-15961 Adobe ColdFusion Unrestricted File Upload Exploited Critical 9.8

All Adobe Coldfusion vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vqvr-95hx-42fj.