Adobe ColdFusion: Unrestricted file upload with arbitrary code execution
Summary
Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 contain an unrestricted file upload vulnerability (CWE-434, CVSS 10.0). An unauthenticated remote attacker can upload a dangerous file and execute arbitrary code in the context of the ColdFusion server, without user interaction. Adobe reports no exploitation in the wild. Some secondary sources describe the vulnerability type differently, so Adobe's bulletin APSB26-144 is authoritative.
Affected
- Adobe ColdFusion 2025: 0 to 2025.0.13
- Adobe ColdFusion 2023: 0 to 2023.0.25
- Platform: all (according to Adobe)
Fixed in
- Adobe ColdFusion 2025 Update 14 (2025.0.14)
- Adobe ColdFusion 2023 Update 26 (2023.0.26)
Workaround
- Unknown. Patching is the complete fix.
- Interim measures only: limit internet exposure of ColdFusion servers, restrict access to trusted IP addresses, and apply the ColdFusion lockdown guide for your version.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this bulletin.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- EPSS: about 0.6% probability of exploitation in the next 30 days (as of 22 Oct 2026).
- No public proof of concept found in our searches. This does not exclude one.
Our recommendation
- Patch to ColdFusion 2025.0.14 or 2023.0.26 as a priority.
- Inventory all ColdFusion instances, including test and legacy servers.
- Until patched, restrict internet access and limit access to trusted IP addresses.
- Check web-accessible directories for unexpected uploaded files.
- Review Adobe bulletin APSB26-144, which covers further vulnerabilities in the same update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- Adobe ColdFusion 2025 Updates release notes guides.adobe.com
- ZDI: October 2026 security update review www.zerodayinitiative.com
- Ionix threat center: CVE-2026-105899 www.ionix.io
- Blacktree: Adobe October 2026 security fixes blacktree.nl
- IsMalicious: CVE-2026-105899 ismalicious.com
- Tenable plugin 366551 www.tenable.com
- Mallory: CVE-2026-105899 mallory.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:17.
Original description (NVD)
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.