CVEs / CVE-2026-27305
CVE-2026-27305: Adobe ColdFusion 2025 vulnerability
- high 8.6 CVSS 3.1 (from the CNA)
- EPSS 26.2% chance of exploitation in the next 30 days, higher than 97% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-27305
Description
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Adobe ColdFusion 2025 | up to and including 6 | — |
| Adobe ColdFusion 2023 | up to and including 18 | — |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.
Severity
| CVSS 3.1 | 8.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-22 |
References
- CVE-2026-27305 on NVD
- https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html Vendor Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.