EXPOSURES › CVE-2026-105899
CVE-2026-105899
CRITICALColdFusion's unrestricted file upload flaw allows attackers to execute arbitrary code without user interaction.
An unpatched vulnerability in ColdFusion enables remote code execution without requiring user interaction, allowing attackers to compromise systems hosting the software. DIB organizations must ensure all ColdFusion instances are patched immediately to prevent unauthorized access and maintain compliance with NIST 800-171 requirements for vulnerability management.
Shame score — The vulnerability allows arbitrary code execution without user interaction, representing a severe, avoidable risk that could lead to system compromise and data breaches if not promptly addressed.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.