CVE-2026-27304
Improper Input Validation in ColdFusion Enables Arbitrary Code Execution
Publication date: 2026-04-14
Last updated on: 2026-04-16
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
| adobe | coldfusion | 2025 |
| adobe | coldfusion | 2023 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects ColdFusion versions 2023.18, 2025.6, and earlier. It is an Improper Input Validation issue that could allow an attacker to execute arbitrary code within the context of the current user. Notably, exploiting this vulnerability does not require any user interaction.
How can this vulnerability impact me? :
The impact of this vulnerability is significant because it allows an attacker to execute arbitrary code with the privileges of the current user. This could lead to unauthorized actions, data compromise, or system manipulation without the need for user interaction.