CVE-2026-27308
LowCVSS 2.4Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Risk Assessment
Exhaustion of system resources may cause ColdFusion application unavailability, impacting critical services and potentially leading to financial or operational losses.
Recommendation
Update ColdFusion to a version later than 2023.18 or 2025.6 that includes the fix, and monitor resource usage to detect potential attacks.
Original NVD description (English source)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.