{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27307", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.401Z", "datePublished": "2026-04-14T21:53:53.899Z", "dateUpdated": "2026-04-15T17:33:11.891Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "ColdFusion", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2026-04-14T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 2.4, "environmentalSeverity": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "ADJACENT_NETWORK", "modifiedAvailabilityImpact": "LOW", "modifiedConfidentialityImpact": "NONE", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "HIGH", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "HIGH", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 2.4, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "Uncontrolled Resource Consumption (CWE-400)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-04-14T21:53:53.899Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ColdFusion | Uncontrolled Resource Consumption (CWE-400)"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:32:55.630208Z", "id": "CVE-2026-27307", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:33:11.891Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction."}], "id": "CVE-2026-27307", "lastModified": "2026-04-15T16:14:07.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "psirt@adobe.com", "type": "Primary"}]}, "published": "2026-04-14T22:16:29.890", "references": [{"source": "psirt@adobe.com", "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "psirt@adobe.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-14T23:51:42.143630+00:00", "value": {"mitigation_remediation": ["Apply the latest security update for Adobe ColdFusion that addresses the resource exhaustion flaw, ensuring the installed version is newer than 2023.18 and 2025.6.", "Restrict and audit high\u2011privilege account usage; remove unnecessary administrative rights to prevent exploitation of the vulnerability.", "Implement application\u2011level request throttling or system resource limits to detect and mitigate sudden spikes in resource consumption."], "summary": {"action": "Patch", "impact": "Application Denial of Service"}, "threat_synthesis": {"affected_systems": "Adobe ColdFusion products released up through version\u202f2023.18 and\u202f2025.6 are affected. The vulnerability applies to all prior releases, including 2023.18, 2025.6, and earlier editions.", "description_and_impact": "Uncontrolled Resource Consumption in Adobe ColdFusion can allow a high\u2011privileged attacker to deplete system resources, causing the application to slow down or become unresponsive. The flaw is a basic resource exhaustion weakness, classified as CWE\u2011400.", "risk_and_exploitability": "The CVSS score of 2.4 indicates a low severity rating, and the EPSS score is not available, implying no publicly known exploit prevalence. The vulnerability does not require user interaction and can be leveraged by anyone with high\u2011level privileges on the affected system. Based on the description, it is inferred that a high\u2011privileged attacker could trigger resource exhaustion, though the specific method is not detailed in the official remarks. The vulnerability is not listed in the CISA KEV catalog, so it has not been confirmed to be actively exploited in the wild."}}}}, "created": "2026-04-15T13:48:23.620320+00:00", "updated": "2026-04-15T14:31:57.029722+00:00", "vendors": ["adobe", "adobe$PRODUCT$coldfusion"]}