CVE-2026-105899

Received Received - Intake

Unrestricted File Upload in Adobe ColdFusion Leads to RCE

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105899

EUVD

EUVD-2026-100502

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	ColdFusion	2025 0
Adobe	ColdFusion	2023 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

ColdFusion has an Unrestricted Upload of File with Dangerous Type vulnerability. This allows attackers to upload malicious files that can execute arbitrary code on the server without user interaction. The scope of the vulnerability is changed, meaning it can affect components beyond the vulnerable one.

Impact Analysis

This vulnerability can allow attackers to take full control of your ColdFusion server, execute malicious code, steal data, or disrupt services. Since exploitation does not require user interaction, attackers can remotely compromise systems easily.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Apply the latest security patches from Adobe for ColdFusion 2025 or 2023 immediately. Disable file upload functionality if not required. Restrict network access to ColdFusion administration interfaces. Monitor for unusual file uploads or code execution attempts.

Hi! I’m here to help you understand CVE-2026-105899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70