9.3 CriticalCWE-20
CVE-2026-27304
ColdFusion | Improper Input Validation (CWE-20)
AdobeColdFusion 2025
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 39% of scored CVEs
SeverityCVSS
9.3Critical
Description NVD
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Coverage 1 article · 1 outlet
- Exploiters target SAP SQLi and Adobe zero day flaws in AprilThe Hacker News · first in our coverage · mentions it in passing