CVE-2026-105899 Overview
CVE-2026-105899 is an Unrestricted Upload of File with Dangerous Type vulnerability [CWE-434] in Adobe ColdFusion. The flaw allows an unauthenticated attacker to upload files containing dangerous content and execute arbitrary code in the context of the current user. Exploitation requires no user interaction and can be triggered remotely over the network. The vulnerability also carries a changed scope, meaning successful exploitation impacts resources beyond the vulnerable component.
Critical Impact
An unauthenticated remote attacker can upload malicious files to vulnerable ColdFusion servers and achieve arbitrary code execution with full confidentiality, integrity, and availability impact.
Affected Products
- Adobe ColdFusion (versions listed in Adobe advisory APSB26-144)
- ColdFusion deployments exposing file upload endpoints to untrusted networks
- ColdFusion application servers running default or unhardened configurations
Discovery Timeline
- 2026-10-13 - CVE-2026-105899 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-105899
Vulnerability Analysis
The vulnerability resides in ColdFusion's file upload handling logic, which fails to adequately validate the type, extension, or content of uploaded files. An attacker can submit a crafted upload request containing an executable payload such as a ColdFusion Markup (.cfm) or scripting file. Once stored within a web-accessible directory, the file can be invoked through a subsequent HTTP request, triggering arbitrary code execution under the privileges of the ColdFusion runtime user.
Because the CVSS scope is marked as changed, exploitation extends beyond ColdFusion itself. An attacker gaining code execution can pivot into the underlying operating system, adjacent services, or back-end databases bound to the ColdFusion host.
Root Cause
The root cause is improper validation of uploaded file metadata and contents, categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type. ColdFusion accepts files whose extension, MIME type, or embedded content can be executed by the server, instead of enforcing a strict allow-list of safe formats and storing uploads outside web-accessible paths.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker crafts an HTTP POST request to a vulnerable upload handler, submits a server-executable payload with a permitted or spoofed extension, and then issues a follow-up request to invoke the uploaded file. For technical details and vendor-supplied indicators, refer to the Adobe ColdFusion Security Advisory APSB26-144.
// No verified public exploit code is available for CVE-2026-105899.
// Refer to the Adobe advisory APSB26-144 for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-105899
Indicators of Compromise
- Unexpected .cfm, .cfml, .cfc, .jsp, or script files written to ColdFusion web-accessible directories such as CFIDE or wwwroot.
- HTTP POST requests to ColdFusion upload endpoints followed by GET requests to newly created files.
- ColdFusion process (coldfusion.exe or jrun.exe) spawning command shells, cmd.exe, powershell.exe, or /bin/sh.
- Outbound network connections initiated by the ColdFusion service to unfamiliar hosts.
Detection Strategies
- Monitor file-system events in ColdFusion install directories for creation of executable server-side scripts by the web service account.
- Inspect web server access logs for anomalous multipart upload requests, large payloads, or suspicious file extensions.
- Correlate upload events with subsequent process creation under the ColdFusion runtime account to identify post-exploitation activity.
Monitoring Recommendations
- Forward ColdFusion application logs, IIS or Apache access logs, and host process telemetry into a centralized analytics platform for correlation.
- Alert on child processes spawned by coldfusion.exe or jrun.exe, especially shells and script interpreters.
- Track outbound connections from ColdFusion servers and alert on traffic to non-approved destinations.
How to Mitigate CVE-2026-105899
Immediate Actions Required
- Apply the security update referenced in Adobe advisory APSB26-144 to all ColdFusion installations immediately.
- Restrict network access to ColdFusion administrative and upload endpoints using firewalls or reverse proxy allow-lists.
- Audit ColdFusion web directories for unauthorized files created since the vulnerability's publication date.
- Rotate credentials, API keys, and secrets accessible to the ColdFusion service account if compromise is suspected.
Patch Information
Adobe has published remediation details in the Adobe ColdFusion Security Advisory APSB26-144. Administrators should identify their installed ColdFusion version and apply the fixed update package provided by Adobe. Verify patch application by comparing installed version numbers against the advisory's fixed releases.
Workarounds
- Place ColdFusion behind a web application firewall configured to block uploads of server-executable file types.
- Configure the web server to deny execution of files in upload directories by removing script handler mappings.
- Run the ColdFusion service under a least-privilege account with no interactive logon rights.
# Example: deny ColdFusion script execution in an upload directory (IIS web.config)
# Place this web.config inside the uploads directory to prevent handler mapping
# <configuration>
# <system.webServer>
# <handlers accessPolicy="Read" />
# </system.webServer>
# </configuration>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
