CVE-2026-27304: ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27304?
The severity of CVE-2026-27304 is high due to its potential for arbitrary code execution without user interaction.
How do I fix CVE-2026-27304?
To fix CVE-2026-27304, upgrade to the latest version of Adobe ColdFusion that is not affected by the vulnerability.
Which versions of Adobe ColdFusion are affected by CVE-2026-27304?
Adobe ColdFusion versions 2023.18 and 2025.6, as well as earlier versions, are affected by CVE-2026-27304.
What type of vulnerability is CVE-2026-27304?
CVE-2026-27304 is classified as an Improper Input Validation vulnerability, leading to potential arbitrary code execution.
Is user interaction required to exploit CVE-2026-27304?
No, exploitation of CVE-2026-27304 does not require any user interaction.