What is the CVSS score of CVE-2026-27304?

CVE-2026-27304 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Coldfusion are affected by CVE-2026-27304?

Adobe ColdFusion versions 2023.18, 2025.6 and earlier contain a critical remote code execution vulnerability (CVSS 9.3) requiring no authentication that allows adjacent network attackers to execute…

How to fix or mitigate CVE-2026-27304?

Within 24 hours: Identify and inventory all ColdFusion 2023.18, 2025.6, and earlier deployments in your environment; isolate affected systems from production networks if possible and restrict network access to ColdFusion ports to trusted sources only. Within 7 days: Contact Adobe Security directly for patch availability status and ETA; implement strict network segmentation and access controls (firewall rules) limiting ColdFusion service access to essential systems only. Within 30 days: Apply vendor patch immediately upon release to all affected ColdFusion instances; validate patch deployment across all systems before restoring normal network access.

Coldfusion CVE-2026-27304

EUVD-2026-22730 CRITICAL

Improper Input Validation (CWE-20)

2026-04-14 psirt@adobe.com

RCE Coldfusion

9.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.3 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22730

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

CRITICAL 9.3

DescriptionCVE.org

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

AnalysisAI

Remote code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows unauthenticated adjacent network attackers to execute arbitrary code via improper input validation. The vulnerability requires no user interaction and achieves scope change, enabling attackers to break out of security boundaries. CVSS 9.3 (Critical). No confirmed active exploitation or public POC identified at time of analysis, but the combination of zero authentication requirements and code execution impact makes this a high-priority patching target for ColdFusion deployments.

Technical ContextAI

Adobe ColdFusion is an enterprise application server platform for building web applications using CFML (ColdFusion Markup Language). This vulnerability stems from CWE-20 (Improper Input Validation), where the application fails to properly validate, sanitize, or reject untrusted input before processing. The affected versions span both the 2023.x and 2025.x release branches, with 2023.18 and 2025.6 representing the vulnerable baseline. The CVSS vector reveals this is an adjacent network attack (AV:A), meaning the attacker must be on the same network segment as the ColdFusion server (such as corporate LAN, data center network, or compromised adjacent system), but does not require internet-wide exposure. The scope change (S:C) indicator suggests successful exploitation allows the attacker to affect resources beyond the vulnerable component's security scope, potentially impacting other applications or system resources managed by ColdFusion.

RemediationAI

Apply the security updates referenced in Adobe Security Bulletin APSB26-38 immediately. Consult the official advisory at https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html for exact patched versions and installation instructions specific to your ColdFusion deployment branch (2023.x or 2025.x). Adobe typically releases updates that increment beyond the vulnerable baseline versions. As a defense-in-depth measure while patching is in progress, implement network segmentation to restrict adjacent network access to ColdFusion servers, deploy web application firewall rules to inspect and validate input to ColdFusion applications, and monitor for unusual code execution patterns or unexpected network connections from ColdFusion processes. Given the no-authentication requirement, perimeter controls and input validation are critical compensating controls until patches are deployed.