CVE-2026-105899
Unauthenticated dangerous file upload RCE in Adobe ColdFusion
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
Adobe ColdFusion is affected by an unrestricted upload of a file with a dangerous type (CWE-434). A remote attacker can trigger it over the network with no privileges and no user interaction, and the vulnerability’s scope is changed. Successful exploitation can run arbitrary code as the current ColdFusion user, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 10.0). The provided data does not name specific ColdFusion versions, so which releases are affected is not known from this record. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the Adobe security update for this CVE as soon as it is available for your ColdFusion release, and until then keep ColdFusion off the public internet (especially upload, connector, and administrator endpoints). Restrict who can reach file-upload features, allow only expected file types, and review recent uploads and ColdFusion logs for unexpected files or new processes running as the ColdFusion user.
| Product | Affected |
|---|---|
| Adobe ColdFusion | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
In the news
0 storiesNo ingested article mentions this CVE yet.