What is the CVSS score of EUVD-2026-22728?

EUVD-2026-22728 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Coldfusion are affected by EUVD-2026-22728?

A security feature bypass vulnerability in Adobe ColdFusion 2023.18, 2025.6, and earlier (CVSS 7.5) allows unauthenticated remote attackers to circumvent access controls and gain unauthorized access…

How to fix or mitigate EUVD-2026-22728?

Within 24 hours: Inventory all ColdFusion deployments and identify instances running versions 2023.18, 2025.6, or earlier. Within 7 days: Implement network-level access controls to restrict ColdFusion application access to trusted sources only; enable comprehensive logging on all ColdFusion instances. Within 30 days: Engage Adobe support for patch availability timeline and evaluate upgrade feasibility to ColdFusion 2025.7 or later once released; conduct access control audit to identify and revoke any unauthorized access.

Coldfusion EUVD-2026-22728

| CVE-2026-27282 HIGH

Improper Input Validation (CWE-20)

2026-04-14 psirt@adobe.com

GHSA-rfcg-4cq5-pfmm

Authentication Bypass Coldfusion

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22728

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

AnalysisAI

Security feature bypass in Adobe ColdFusion 2023.18, 2025.6, and earlier allows remote unauthenticated attackers to circumvent security controls via improper input validation, potentially enabling unauthorized access to protected resources. The vulnerability carries a CVSS score of 7.5 with high integrity impact, though exploitation reportedly requires user interaction per the description. No public exploit code or active exploitation confirmed at time of analysis, but the authentication bypass classification indicates potential for privilege escalation or access control circumvention.

Technical ContextAI

This vulnerability stems from CWE-20 (Improper Input Validation) in Adobe ColdFusion's security enforcement mechanisms. ColdFusion is a commercial rapid web application development platform that processes CFML (ColdFusion Markup Language) and integrates with Java application servers. Improper input validation in security-critical code paths can allow attackers to craft malicious inputs that bypass authentication checks, authorization filters, or other protective controls. The affected versions span both the 2023 and 2025 product lines (through 2023.18 and 2025.6 respectively), suggesting a persistent architectural weakness in input handling within the platform's security layer rather than an isolated code defect.

RemediationAI

Apply the vendor-released security updates documented in Adobe Security Bulletin APSB26-38 available at https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html. Organizations running ColdFusion 2023 should upgrade to the patched version specified in the bulletin (likely Update 19 or later), while ColdFusion 2025 deployments should upgrade to the fixed release (likely Update 7 or later). The bulletin will specify exact patched versions and installation procedures. As an interim mitigation if immediate patching is not feasible, implement strict network segmentation to limit ColdFusion exposure, deploy web application firewall rules to inspect and sanitize inputs to ColdFusion endpoints, and review access logs for anomalous authentication patterns or unexpected privilege escalations. However, these workarounds do not eliminate the vulnerability and patching remains the definitive remediation.