Platform
coldfusion
Component
coldfusion
Fixed in
2025.6.1
CVE-2026-27307 describes an Uncontrolled Resource Consumption vulnerability in ColdFusion. This flaw allows a high-privileged attacker to exhaust system resources, leading to a denial-of-service condition and reduced application performance. The vulnerability impacts ColdFusion versions from 0.0.0 up to and including 2025.6. A patch is available in version 2025.6.1.
Successful exploitation of CVE-2026-27307 allows an attacker to initiate a denial-of-service (DoS) condition within a ColdFusion application. The attacker can trigger excessive resource consumption, such as CPU or memory, effectively slowing down or crashing the application. This can disrupt service availability for legitimate users and potentially impact other services running on the same server. While the vulnerability does not require user interaction, it necessitates an attacker with elevated privileges within the ColdFusion environment to execute the attack.
CVE-2026-27307 was publicly disclosed on 2026-04-14. The vulnerability has a LOW CVSS score, indicating a relatively low probability of exploitation. No public proof-of-concept (PoC) code has been released at the time of writing, and there are no reports of active exploitation campaigns. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.02% (6% percentile)
CISA SSVC
The primary mitigation for CVE-2026-27307 is to upgrade to ColdFusion version 2025.6.1 or later, which includes the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing rate limiting on resource-intensive operations within the ColdFusion application to prevent excessive consumption. Monitoring system resource utilization (CPU, memory) is also recommended to detect potential attacks. After upgrading, confirm the fix by attempting to reproduce the resource exhaustion condition and verifying that it no longer occurs.
Adobe recomienda aplicar la actualización a ColdFusion versión 2025.6.1 o posterior para mitigar la vulnerabilidad de consumo excesivo de recursos. Consulte la página de Adobe Security Advisory APSB26-38 para obtener más detalles e instrucciones de instalación.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27307 is a denial-of-service vulnerability in ColdFusion affecting versions 0.0.0–2025.6. An attacker can exhaust system resources, leading to application slowdown or crashes.
You are affected if you are running ColdFusion versions 0.0.0 through 2025.6. Upgrade to 2025.6.1 or later to mitigate the risk.
Upgrade to ColdFusion version 2025.6.1 or a later version. Consider rate limiting and monitoring system resources as interim measures.
There are currently no reports of active exploitation campaigns for CVE-2026-27307, but vigilance is still advised.
Refer to the Adobe Security Bulletin for CVE-2026-27307 on the Adobe Security Advisories website.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.