CVE-2026-27307: low-severity vulnerability in Adobe ColdFusion 2023
ColdFusion | Uncontrolled Resource Consumption (CWE-400)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.4epss 2.7%
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Related CVEs — Adobe ColdFusion 2023
In the same product, most dangerous first.
CVE-2026-48282CRITICALColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 42.4%KEVCVE-2026-27305HIGHColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 26.3%CVE-2026-34619HIGHColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 7.6%CVE-2026-27304CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 3.6%CVE-2026-48362CRITICALColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%CVE-2026-48313CRITICALColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 3.0%