CVE-2026-27304
Published: 14 April 2026
Summary
CVE-2026-27304 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Adobe Coldfusion. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of software flaws like this improper input validation vulnerability in ColdFusion, enabling application of vendor patches from APSB26-38 to prevent RCE.
Directly mandates validation of information inputs to counter the CWE-20 improper input validation that allows arbitrary code execution without user interaction.
Enforces boundary protection to monitor and control communications from adjacent networks, blocking the AV:A vector needed for low-complexity exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary code execution via improper input validation in Adobe ColdFusion (a web application server) directly enables exploitation of public-facing applications for initial access.
NVD Description
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Deeper analysisAI
CVE-2026-27304 is an Improper Input Validation vulnerability (CWE-20) affecting Adobe ColdFusion versions 2023.18, 2025.6, and earlier. Published on 2026-04-14, it enables arbitrary code execution in the context of the current user without requiring user interaction. The issue has a CVSS v3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
An attacker on an adjacent network can exploit this vulnerability with low complexity and no privileges or user interaction needed. Successful exploitation results in high impacts to confidentiality and integrity, with a changed scope, allowing arbitrary code execution as the current user.
The Adobe Security Bulletin APSB26-38 provides details on mitigation and patches; see https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html.
Details
- CWE(s)