CVE-2026-27304
Adobe ColdFusion versions 2023.18, 2025.6 and earlier contain a flaw that lets attackers run arbitrary code on the server without any user interaction. The vulnerability is caused by improper input validation and can be triggered by sending crafted requests to the affected system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Adobe ColdFusion 2023.18, 2025.6 and all earlier releases. Typical users are web developers and system administrators who host ColdFusion applications.
Real-world impact
An attacker could execute any code on the server with the privileges of the current user, potentially taking over the system, exfiltrating data, or installing malware.
Why this severity
The CVSS score of 9.3 reflects that the flaw is exploitable over the network (Adjacency), requires no privileges, and allows code execution with the current user's rights. The lack of user interaction and the high impact on confidentiality and integrity drive the score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 14, 2026 · Apr 14, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 25, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- helpx.adobe.com/security/products/coldfusio…vendor advisory