Loading vulnerability…
Unauthenticated Code Execution via Unrestricted File Upload in Adobe ColdFusion
CVE-2026-105899 is an unrestricted upload of files with dangerous types vulnerability affecting Adobe ColdFusion 2023 releases before Update 26 and ColdFusion 2025 releases before Update 14 on all platforms. A remote, unauthenticated attacker can exploit the flaw to execute arbitrary code in the context of the current user without user interaction. The vulnerability is rated critical with a CVSS score of 10.0 and changed scope. The specific vulnerable function and upload endpoint are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution under the current user's privileges. The CVSS assessment indicates high impacts across all three dimensions and a changed security scope, although the additional security boundary affected is not specified.
If you can’t patch tonight, do this now.
Restrict file uploads to explicitly allowed safe file types and review server security configurations. Apply the relevant ColdFusion Lockdown Guide recommendations as defense in depth. These measures are not established substitutes for patching; no vulnerability-specific temporary workaround is documented.
Patch, then assume compromise.
Upgrade Adobe ColdFusion 2023 to Update 26 (2023.0.26) or ColdFusion 2025 to Update 14 (2025.0.14), or a later supported release containing the fix, following Adobe security bulletin APSB26-144 and the applicable installation instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.