CVE-2026-27304CWE-20

CVE-2026-27304

Critical · published April 15, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-04-15T02:16Z
Affected products (26)
ProductVersionsFixed in
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
References (1)
https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html · [email protected]
EPSS history
Timeline
  • 14 APR 21:53Z
    ColdFusion | Improper Input Validation (CWE-20)
    cvelistv5