Patchfirst
Patchfirst
CVE-2026-105899 Critical · 10.0 EPSS 1.0%

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…

Adobe · ColdFusion 2025

Summary

Adobe ColdFusion 2025 contains an unrestricted file upload flaw (classified as unrestricted upload of a file with a dangerous type) in its file handling. An attacker who can reach the affected component over the network, with no privileges and no user interaction, can upload a dangerous file type and achieve arbitrary code execution in the context of the current user, with scope changed.

Official description · NVD

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Breakdown
22.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 13 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Vendor Advisory 1

adobe.com/trust/security/products/coldfusion/apsb26-144.html
↑ ↓ chooseEnter openEsc close