CVE-2026-27304: coldfusion vulnerability

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVE-2026-27304CVSS 9.3General

CVE-2026-27304: coldfusion vulnerability

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

CVSS
9.3 CRITICAL
EPSS
89.39%
Known exploited
not in KEV
Product
coldfusion

What is known

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Sources

Back to security hubContact DataHouse