Skip to content
OpenAdvisories
High WID-SEC-2026-1110 7 CVEs

Adobe ColdFusion: Mehrere Schwachstellen

Published Apr 14, 2026 · Updated Apr 15, 2026 · Revision 2 · de-DE

Vendor: Adobe Product: ColdFusion Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.

Vulnerabilities 7

  • Critical 9.3
    CVE-2026-27304

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 8.6
    CVE-2026-27305 EPSS 27%

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to acce…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 8.4
    CVE-2026-27306

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requ…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 7.7
    CVE-2026-34619

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to ac…

    Adobe ColdFusion 2023 ColdFusion 2025
  • High 7.5
    CVE-2026-27282

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. …

    Adobe ColdFusion 2025 ColdFusion 2023
  • Low 2.4
    CVE-2026-27307

    ColdFusion | Uncontrolled Resource Consumption (CWE-400)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, redu…

    Adobe ColdFusion 2025 ColdFusion 2023
  • Low 2.4
    CVE-2026-27308

    ColdFusion | Uncontrolled Resource Consumption (CWE-400)

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, redu…

    Adobe ColdFusion 2025 ColdFusion 2023

Revision history

  1. #2

    Referenz(en) aufgenommen: ZDI-26-263, ZDI-CAN-30200, ZDI-26-264, ZDI-CAN-29550, ZDI-26-262, ZDI-CAN-29549

  2. #1

    Initiale Fassung

References