CVE Intelligence
Analysis AI-assisted

CVE-2026-27304: Adobe ColdFusion - Improper Input Validation (CWE-20)

CVE-2026-27304 is an improper input validation weakness (CWE-20) in Adobe ColdFusion. The CNA describes it as allowing arbitrary code execution in the context of the current user, without user interaction, and the CNA score is 9.3 (critical). The sources consulted do not report confirmed exploitation, and the record lists no fixed build, so the vendor advisory APSB26-38 should be checked.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27304 affects Adobe ColdFusion. The CNA describes an improper input validation weakness (CWE-20) that could result in arbitrary code execution in the context of the current user, and states that exploitation does not require user interaction.

Impact

  • Arbitrary code execution in the context of the current user, as described by the CNA.
  • CNA CVSS score of 9.3 (critical).
  • The vector in the record indicates network-adjacent attack vector, low complexity, no privileges required, no user interaction, changed scope, and high confidentiality and integrity impact, with no availability impact.
  • SSVC technical impact is recorded as total.

Affected products and versions

  • Adobe ColdFusion branch 2023, up to and including 2023.18.
  • Adobe ColdFusion branch 2025, up to and including 2025.6.
  • The record also lists individual update builds under the 2023 and 2025 branches.
  • The record contains no fixed version. This does not mean no fix exists; consult the vendor advisory.

Exploitation status

  • The CISA KEV catalogue does not list this CVE in the record (kev.listed is false), so active exploitation is not confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none and automatable as no.
  • The EPSS probability is 0.00457 with a percentile of 0.38715.

Remediation and mitigation

  • Review the vendor advisory APSB26-38 and apply the update that corresponds to your ColdFusion branch.
  • Confirm the installed build after patching and record the result.
  • Limit network exposure of ColdFusion services to trusted networks until patched.
  • Run the service with least privilege so that a compromise has a smaller footprint.

Detection guidance

  • Review ColdFusion application and access logs for unexpected requests or input patterns, at a high level.
  • Monitor for unexpected child processes or changes to files created by the ColdFusion service account.
  • Keep endpoint and network telemetry for the ColdFusion host under review during the patching window.

Limitations of the available information

  • The record does not provide a fixed build number.
  • The record does not describe the vulnerable component or the specific input involved.
  • The full vendor advisory was not part of the record, so update details must be taken from the vendor directly.
  • EPSS and SSVC values come from the record and may change over time.

Frequently asked questions

What is CVE-2026-27304?

It is an improper input validation weakness (CWE-20) in Adobe ColdFusion that the CNA says could allow arbitrary code execution as the current user without user interaction.

Is this vulnerability being actively exploited?

The CISA KEV catalogue does not list it in this record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists ColdFusion branch 2023 up to and including 2023.18 and branch 2025 up to and including 2025.6, along with individual update builds.

What should administrators do?

Review the vendor advisory APSB26-38, apply the update for your branch, confirm the installed build, and limit network exposure until patched.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.