CVE-2026-105899 Adobe CVE debrief

Who should care

Defenders responsible for ColdFusion deployments, especially those with file upload functionality exposed to untrusted users, should assess exposure and apply updates. This includes verifying exposure, applying vendor-provided updates, and monitoring for suspicious file uploads and system changes. Additionally, defenders should review compensating controls for exposed systems and track exceptions, retest remediated assets, and close the item only after is

Why it matters

CVE-2026-105899 is a critical vulnerability in ColdFusion 2025 and 2023 that allows for arbitrary code execution through unrestricted file uploads. Defenders should verify exposure, especially if file upload functionality is exposed to untrusted users, and apply vendor-provided updates immediately.

• Potential arbitrary code execution in the context of the current user.
• Possible system compromise through unrestricted file uploads.
• Need for immediate verification of exposure and application of vendor-provided updates.
• Requirement for monitoring suspicious file uploads and system changes.

Technical summary

ColdFusion 2025 and 2023 are affected by an Unrestricted Upload of File with Dangerous Type vulnerability, potentially allowing arbitrary code execution. The vulnerability has a CVSS score of 10 and is considered critical. Exploitation of this issue does not require user interaction. Scope is changed. Defenders should verify exposure, especially if file upload functionality is exposed to untrusted users, and apply vendor-provided updates immediately. This vulnerability allows for arbitrary code execution in the context of the current user.

Defensive priority

Defenders should prioritize verifying exposure of ColdFusion 2025 and 2023 deployments, assessing if file upload functionality is exposed to untrusted users, and applying vendor-provided updates.

Recommended defensive actions

• Verify ColdFusion deployments for exposure, especially if file upload functionality is exposed to untrusted users.
• Apply vendor-provided updates to affected versions.
• Monitor for suspicious file uploads and system changes.
• Restrict file uploads to trusted users and validate file types.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item indicate an Unrestricted Upload of File with Dangerous Type vulnerability in ColdFusion 2025 and 2023. Vendor advisory APSB26-144 provides additional details. The vulnerability has a CVSS score of 10 and is considered critical. Defenders should verify exposure, especially if file upload functionality is exposed to untrusted users, and apply vendor-provided updates immediately.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.