CVE-2026-27306: ColdFusion | Improper Input Validation (CWE-20)
Published Apr 14, 2026
·Updated
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
27 affected components
Adobe ColdFusion<=2023.18, <=2025.6
Adobe ColdFusion=2023
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update13
Adobe ColdFusion=2023-update14
Adobe ColdFusion=2023-update15
Adobe ColdFusion=2023-update16
Adobe ColdFusion=2023-update17
Adobe ColdFusion=2023-update18
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025
Adobe ColdFusion=2025-update1
Adobe ColdFusion=2025-update2
Adobe ColdFusion=2025-update3
Adobe ColdFusion=2025-update4
Adobe ColdFusion=2025-update5
Adobe ColdFusion=2025-update6
Event History
Apr 14, 2026
CVE Published
via MITRE·09:53 PM
Data Sourced
via MITRE·09:53 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-27306?
CVE-2026-27306 has a high severity due to its potential for arbitrary code execution.
2
How do I fix CVE-2026-27306?
To remediate CVE-2026-27306, upgrade to a version of ColdFusion that is later than 2023.18 or 2025.6.
3
Which versions of ColdFusion are affected by CVE-2026-27306?
CVE-2026-27306 affects Adobe ColdFusion versions 2023.18, 2025.6, and earlier.
4
What type of vulnerability is CVE-2026-27306?
CVE-2026-27306 is categorized as an Improper Input Validation vulnerability (CWE-20).
5
What privileges are required to exploit CVE-2026-27306?
Exploitation of CVE-2026-27306 requires elevated privileges.