by Kastro
Paper/Archive/CVE-2026-27304

CVE-2026-27304

Adobe ColdFusion 2025 — ColdFusion | Improper Input Validation (CWE-20)

EPSS 4%CVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 89.5.895 × 2017.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
ColdFusion 2025≤ 67CNA
ColdFusion 2023≤ 1819CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/coldfusion/apsb26-38.html