Advisory · CVE-2026-105899
Unrestricted dangerous file upload in ColdFusion gives unauthenticated code execution
ColdFusion lets an attacker upload a file of a dangerous type without adequate restriction, which can become arbitrary code execution with changed scope and no authentication. Adobe rates it CVSS 3.1 10.0.
- Vendor
- Adobe
- Product
- ColdFusion
- Identifier / CWE
- CVE-2026-105899
CWE-434 - Action timing
- Immediate
Explain it like I’m five
The server accepts an executable file from a stranger and puts it somewhere it can be run, which is the whole attack in one sentence.
- 01Upload a dangerous file
An unauthenticated attacker uploads a file whose type ColdFusion should have blocked.
- 02File is stored accessibly
The upload lands in a location the server will execute or serve.
- 03Code executes
The attacker's file runs in the ColdFusion service context.
What happened
Adobe disclosed CVE-2026-105899 in bulletin APSB26-144: an unrestricted upload of a file with a dangerous type (CWE-434) in ColdFusion that could result in arbitrary code execution, requiring neither authentication nor user interaction.
Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.
What to do
- Inventory every ColdFusion deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
- Review application and server logs for newly uploaded files with executable extensions, upload requests from unfamiliar sources, and web-accessible files outside normal deployments.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
A 10.0 upload-to-execution flaw on an application server is patch-immediately territory, with a web shell hunt right behind it.