What is the CVSS score of CVE-2026-27305?

CVE-2026-27305 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Coldfusion are affected by CVE-2026-27305?

CVE-2026-27305 is a critical path traversal vulnerability in Adobe ColdFusion 2023.18, 2025.6 and earlier that allows unauthenticated attackers to read arbitrary files from affected servers without…

How to fix or mitigate CVE-2026-27305?

Within 24 hours: Identify and inventory all ColdFusion 2023.18 and 2025.6 instances; restrict network access to ColdFusion administration and application ports using firewall rules or WAF policies; implement request filtering to block path traversal patterns (../, ..\ sequences). Within 7 days: Contact Adobe for patch availability and timeline; evaluate offline or air-gapped deployment options as interim measures; implement enhanced logging and monitoring for file access anomalies. Within 30 days: Apply vendor patch immediately upon release; conduct forensic review of access logs for unauthorized file read attempts; validate remediation across all affected instances.

Coldfusion CVE-2026-27305

EUVD-2026-22732 HIGH

Path Traversal (CWE-22)

2026-04-14 psirt@adobe.com

Path Traversal Coldfusion

8.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22732

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 8.6

DescriptionCVE.org

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.

AnalysisAI

Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier enables unauthenticated remote attackers to read arbitrary files from the server file system without user interaction. The vulnerability carries a CVSS score of 8.6 (High) due to network accessibility, low complexity, and scope change, allowing access to sensitive files and directories beyond intended boundaries. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the lack of authentication requirements and low attack complexity suggest elevated risk for publicly accessible ColdFusion instances.

Technical ContextAI

ColdFusion is Adobe's Java-based application server for building dynamic web applications. This vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The flaw occurs when user-supplied input containing directory traversal sequences (such as '../' or absolute paths) is insufficiently validated before being used in file system operations. Without proper canonicalization and validation of file paths, attackers can manipulate path references to escape the application's intended directory structure and access arbitrary files readable by the ColdFusion process. The CVSS Changed Scope (S:C) indicator suggests the vulnerability may allow reading files beyond the security scope of the vulnerable ColdFusion component itself, potentially exposing operating system files, configuration files containing credentials, application source code, or other sensitive data stored on the server.

RemediationAI

Apply the security updates provided in Adobe Security Bulletin APSB26-38 immediately, prioritizing internet-facing ColdFusion installations. Specific patched versions are documented in the bulletin at https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html. As an interim mitigation, restrict network access to ColdFusion administrative interfaces and application endpoints using firewall rules, IP allowlisting, or VPN requirements to limit exposure to trusted networks only. Review and minimize file system permissions granted to the ColdFusion process user account to reduce the scope of accessible files. Implement web application firewall (WAF) rules to detect and block common path traversal patterns in HTTP requests, such as encoded or repeated directory traversal sequences, though this should be considered defense-in-depth rather than a primary remediation. Monitor ColdFusion access logs for suspicious patterns including encoded characters, excessive parent directory references, or attempts to access system files.