Product:
ColdFusion
Summary
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-27282 |
Exploitation
To exploit this vulnerability, an attacker must trick a user into interacting with a malicious input that bypasses the security features of ColdFusion. This could involve social engineering tactics to convince the user to perform actions that would allow the attacker to gain unauthorized access to the system.
Affected Products
- ColdFusion 2023.18: Affected by improper input validation leading to potential security feature bypass.
- ColdFusion 2025.6: Similar vulnerability allowing unauthorized access through security measure bypass.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of ColdFusion and apply any available security patches. Additionally, implementing strict input validation and user interaction controls can help prevent exploitation.