Key points
- The National Vulnerability Database rates CVE-2026-105899 as critical with a CVSS score of 10.0.
- The flaw allows unrestricted upload of dangerous file types, leading to arbitrary code execution.
- Affected versions include Adobe ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25.
The short version
- Adobe ColdFusion contains a critical vulnerability identified as CVE-2026-105899.
- The issue stems from an unrestricted upload of files with dangerous extensions.
- Successful exploitation allows remote code execution without requiring any user interaction.
The details
The National Vulnerability Database has assigned a CVSS score of 10.0 to CVE-2026-105899, categorizing the severity as critical. This rating reflects the high potential for damage and the ease with which attackers can exploit the flaw. The vulnerability is classified under CWE-434, which pertains to the unrestricted upload of files with dangerous types. This means the application fails to properly validate or restrict the types of files that users can upload to the server.
An attacker can exploit this issue to execute arbitrary code in the context of the current user. The NVD record explicitly states that exploitation of this vulnerability does not require user interaction. This makes the threat particularly severe, as attackers can launch automated scans and exploit the flaw remotely without needing to trick a user into clicking a link or opening a file. The scope of the vulnerability is noted as changed in the NVD record.
The context
The vulnerability affects specific ranges of Adobe ColdFusion versions. According to the NVD record, Adobe ColdFusion 2025 versions up to and including 2025.0.13 are affected. Additionally, Adobe ColdFusion 2023 versions up to and including 2023.0.25 are also vulnerable to this exploit. Organizations running these specific versions or earlier updates within those release lines are exposed to the risk of remote code execution through file upload mechanisms.
What to watch
Organizations should monitor their ColdFusion servers for unusual file uploads or unexpected process executions. Security teams should check for any unauthorized scripts or executables appearing in upload directories. Since the flaw allows code execution in the context of the current user, attackers may attempt to escalate privileges or pivot to other systems. Watch for outbound connections from the server to unknown external IP addresses, which could indicate data exfiltration or command-and-control communication.
What it means for organisations
Security teams must immediately inventory all ColdFusion instances to determine if they fall within the affected version ranges. Operations managers should prioritize patching or mitigating these systems due to the critical severity and lack of required user interaction. Suppliers providing ColdFusion-based services need to verify their infrastructure status with clients. Internal stakeholders, including IT directors and risk officers, should be informed of the potential for remote code execution. Teams usually conduct emergency maintenance windows to apply fixes or implement temporary restrictions on file upload capabilities to reduce exposure while permanent solutions are evaluated.
What to do and how to stay safe: Adobe ColdFusion
- Inventory all Adobe ColdFusion servers to identify if they are running versions 2025.0.13 or earlier, or 2023.0.25 or earlier.
- Restrict file upload permissions to prevent the execution of dangerous file types until a vendor update is available.
- Monitor server logs for unauthorized code execution or unexpected process spawns associated with file upload activities.
- Isolate affected systems from critical network segments if immediate patching is not possible to limit lateral movement.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Adobe ColdFusion versions are affected by CVE-2026-105899?
Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction according to the NVD record.
What is the CVSS score for this vulnerability?
The NVD rates CVE-2026-105899 with a CVSS score of 10.0, which is considered critical.
