Product:
ColdFusion
Summary
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-27304 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted input to the affected ColdFusion application. Since the vulnerability allows for arbitrary code execution, the attacker can execute malicious code in the context of the current user without requiring any user interaction, making it particularly dangerous.
Affected Products
- ColdFusion 2023.18: Affected by improper input validation leading to potential arbitrary code execution.
- ColdFusion 2025.6: Vulnerable to the same input validation issue, allowing for code execution.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the improper input validation issue. Regularly applying security patches and following best practices for input validation can also help reduce the risk of exploitation.