Adobe ColdFusion 2025 and 2023 contain a CVSS 10.0 file upload flaw (CVE-2026-105899) that can lead to arbitrary code execution without authentication or user interaction.
What Is It
CVE-2026-105899 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Adobe ColdFusion. According to Adobe's description, successful exploitation could result in arbitrary code execution in the context of the current user. Adobe notes that exploitation does not require user interaction and that the scope is changed.
Adobe PSIRT submitted the record, and NVD published it on 2026-10-13. Its NVD status is currently "Received," so NVD has not finished its analysis.
Why It Matters
Adobe rates the flaw 10.0 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H):
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability
This combination means a remote attacker with no credentials could exploit the flaw over the network. Because the scope is changed, the impact could reach beyond the vulnerable component.
KEV status: CVE-2026-105899 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and active exploitation has not been publicly confirmed at the time of writing. Defenders should still treat the severity rating as reason enough to patch quickly.
What's Vulnerable
According to the affected-version data from Adobe PSIRT:
| Product | Affected | First unaffected version |
|---|---|---|
| ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
Adobe marks all other versions of these products as unaffected by default. The NVD record does not list any CPEs yet.
Patch Status
Adobe lists fixed versions for both affected release lines:
- ColdFusion 2025: update to 2025.0.14 or later
- ColdFusion 2023: update to 2023.0.26 or later
Adobe's security bulletin APSB26-144 covers this issue. Administrators should check the bulletin for update instructions. Because the CVE is not in the KEV catalog, CISA has not issued a required action or federal remediation deadline. Prioritize internet-facing ColdFusion servers, since the flaw is network-reachable and needs no authentication.