Adobe ColdFusion CVE-2026-105899

Exploitation requires a ColdFusion 2023 (≤2023.0.25) or ColdFusion 2025 (≤2025.0.13) instance exposing a file-upload-capable endpoint reachable by the attacker; the flaw is the server accepting and storing a file of a dangerous/executable type (CWE-434) without adequate restriction, which is then executed. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so default network-exposed deployments of these versions are at risk. Limiting factors: the server must be network-reachable and running an affected version; environments that front ColdFusion with upload filtering/WAF rules, restrict the upload directory from execution, or have already applied the APSB26-144 update are not exploitable. The description's 'context of the current user' wording suggests resulting privileges may track the ColdFusion service account rather than always root/SYSTEM.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk paper cut. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) describes the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, with a scope change and full confidentiality/integrity/availability impact. CWE-434 (unrestricted upload of dangerous file type) leading to code execution on a widely targeted enterprise application server (Adobe ColdFusion) is a historically proven attack class - prior ColdFusion upload/deserialization flaws have repeatedly ended up in CISA KEV. For THIS CVE, however, no EPSS score, no KEV listing, and no POC indicator were supplied, so current exploitation evidence is 'no public exploit identified at time of analysis.' One signal to verify: the description states code execution occurs 'in the context of the current user,' which is a narrower impact phrasing than the S:C/C:H/I:H/A:H the Adobe-supplied vector claims - the vendor vector and the prose are not fully consistent, so confirm the actual privilege context against Adobe APSB26-144. Absence of EPSS/KEV reflects that this is a freshly disclosed vendor-reported issue, not evidence of low risk; given the product's attacker interest, treat it as imminently exploitable and patch urgently.

A remote, unauthenticated attacker sends a crafted upload request to an internet-facing ColdFusion 2023 or 2025 server, placing a file of a dangerous type (e.g., a CFM/JSP webshell) into a web-accessible location. They then request that file to execute arbitrary code on the server. No public exploit is identified at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means weaponization would be straightforward once internals are known.