CVE-2026-105899

Executive Summary

CVE-2026-105899 is a critical (CVSS 10.0) unrestricted file upload vulnerability (CWE-434) affecting ColdFusion. The flaw allows an unauthenticated, remote attacker to upload a file of dangerous type and thereby execute arbitrary code within the context of the current user, with a changed scope indicating impact beyond the vulnerable component. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability is unpatched with zero patch confidence across all tracked sources.

Technical Analysis

The vulnerability is classified under CWE-434, Unrestricted Upload of File with Dangerous Type. This weakness class occurs when an application allows users to upload files without adequately validating the file type, extension, or content, permitting the upload of executable or otherwise dangerous file formats that the server may subsequently process or serve.

In the context of ColdFusion, the attack surface is the application's file upload handling path exposed over the network. Because the CVSS vector is AV:N (network), AC:L (low complexity), PR:N (no privileges required), and UI:N (no user interaction), the vulnerable upload endpoint is reachable by an unauthenticated remote actor without any preconditions or victim interaction.

The description states that successful exploitation "could result in arbitrary code execution in the context of the current user" and that the "scope is changed" (S:C). A changed scope in CVSS 3.1 indicates that the exploited vulnerable component impacts resources beyond its security scope — meaning code execution is not necessarily confined to the ColdFusion process security context but can affect the underlying host or adjacent resources. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), consistent with full compromise of the affected system.

The description does not disclose specific endpoint paths, parameter names, upload field identifiers, function names, or file-type validation logic. Per accuracy constraints, those implementation details are not fabricated here. The material facts derivable from the provided data are: (1) the vulnerability is an unrestricted dangerous-file upload, (2) it is remotely triggerable without authentication or interaction, (3) it leads to arbitrary code execution, and (4) exploitation can escape the original security scope.

No vendor fix, workaround, or affected version range is available from tracked sources, and no patch evidence exists from any source, yielding a patch confidence of 0/4 (UNPATCHED).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-434) and the supplied NVD description. No specific function names, endpoints, file paths, or parameters are invented.

1. Reconnaissance / target identification: An attacker identifies internet-facing ColdFusion deployments. Because the vector is AV:N and PR:N, the target is any reachable instance exposing its upload functionality. Shodan queries such as product:"ColdFusion" or http.title:"ColdFusion Administrator" can be used to enumerate candidate hosts.

2. Triggering the flaw class: The attacker locates a network-accessible file upload feature that accepts user-supplied files without enforcing a safe allowlist of file types. Because the description notes no user interaction is required, the upload can be performed directly by the attacker against the service. The absence of privilege requirements (PR:N) means no prior authentication is needed.

3. Payload / execution method (class level): The attacker uploads a file of a dangerous type — a file whose format the server may store, serve, or process in a way that permits code execution. The precise mechanism by which the uploaded file is executed is not disclosed in the provided description and is therefore not specified here. The dangerous-type upload is the enabling primitive that results in arbitrary code execution.

4. Post-exploitation impact: Successful execution yields arbitrary code running in the context of the current user, with a changed scope (S:C) indicating the compromise can extend beyond the vulnerable component's intended boundary. This enables confidentiality, integrity, and availability impact rated High across all three axes, potentially including host-level compromise, data theft, and service disruption.

Impact Assessment

The CVSS 3.1 base score is 10.0 (Critical), reflecting the maximum exploitability and impact profile: network-exploitable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), changed scope (S:C), and High confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Business impact is severe. A CVSS 10.0 unauthenticated remote code execution vector on a web application platform typically translates to complete host compromise, allowing attackers to read, modify, or destroy sensitive data; deploy persistence; pivot to internal networks; and disrupt availability of the hosted application. Because ColdFusion instances frequently sit at the network edge and may serve customer-facing or internal business applications, the blast radius can extend from a single application to the entire host and any systems reachable from it — consistent with the changed-scope rating.

Affected systems are ColdFusion deployments exposing the vulnerable upload functionality to untrusted networks. No affected version range is available from tracked sources, so all exposed instances should be treated as potentially vulnerable pending vendor clarification.

No CISA KEV listing is present, and no evidence of active exploitation, threat actor campaign, or public exploit is available in the supplied data. However, unauthenticated RCE vulnerabilities of this class are historically attractive to both opportunistic and targeted actors and should be prioritized accordingly.

Detection Guidance

Sigma Rule

title: Suspicious Dangerous File Upload to ColdFusion
id: 8f3c1b2a-4d5e-4f6a-9b7c-2e1d0a9c8b7a
status: experimental
description: Detects HTTP POST requests containing multipart uploads with dangerous file extensions targeting ColdFusion endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105899
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_multipart:
    cs-uri-query|contains: 'upload'
  selection_ext:
    cs-uri-query|endswith:
      - '.jsp'
      - '.jspx'
      - '.cfm'
      - '.cfml'
      - '.war'
      - '.jar'
  condition: selection_method and selection_multipart and selection_ext
falsepositives:
  - Legitimate administrative uploads by authorized developers
level: high
tags:
  - attack.t1190
  - cve.2026.105899

YARA Rule

rule CVE_2026_105899_Dangerous_Upload_ColdFusion
{
    meta:
        description = "Detects dangerous file types associated with CWE-434 uploads targeting ColdFusion"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105899"
        date = "2026-01-01"
        cve = "CVE-2026-105899"
    strings:
        $ext1 = ".jsp" ascii nocase
        $ext2 = ".jspx" ascii nocase
        $ext3 = ".cfm" ascii nocase
        $ext4 = ".cfml" ascii nocase
        $ext5 = ".war" ascii nocase
        $upload = "multipart/form-data" ascii nocase
        $cfide = "cfide" ascii nocase
    condition:
        $upload and 1 of ($ext*) and $cfide
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105899 ColdFusion Dangerous File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload"; nocase; http.request_body; content:"Content-Disposition"; nocase; http.request_body; content:".cfm"; nocase; http.request_body; content:".jsp"; nocase; distance:0; sid:2026105899; rev:1; reference:cve,2026-105899; classtype:web-application-attack;)

Elastic Detection

sequence by host.id, source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
    http.request.body.content : "*multipart/form-data*" and
    http.request.body.content : ("*.jsp*" or "*.cfm*" or "*.cfml*" or "*.war*") ]
  [ file where event.action == "creation" and file.extension : ("jsp" or "cfm" or "cfml" or "war") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| search method=POST
| where match(uri, "(?i)upload") AND match(uri, "(?i)\.(jsp|jspx|cfm|cfml|war|jar)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,coldfusion,CVE-2026-105899,">
  <rule id="105899" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <regex>upload.*\.(jsp|jspx|cfm|cfml|war|jar)</regex>
    <description>CVE-2026-105899: Possible ColdFusion dangerous file upload attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is available from the supplied data.

1. Immediate mitigations:

   • Restrict network access to ColdFusion upload functionality using firewalls, WAF rules, or reverse-proxy allowlists; do not expose upload endpoints to untrusted networks.
   • Deploy virtual patching at the WAF layer to block uploads of dangerous file types (e.g., server-executable extensions) via request-body inspection and extension allowlisting.
   • Disable or tightly constrain any unauthenticated file upload features until a vendor fix is confirmed.
   • Enforce file-type validation server-side, using content-based checks and a safe extension allowlist rather than client-supplied MIME types or extensions alone.
   • Store uploaded files outside the web root and serve them without execution privileges.

2. Patch/upgrade steps:

   • No patch is currently available from tracked sources. Monitor Adobe's ColdFusion security advisory channel and the NVD entry for CVE-2026-105899 for an official fix and affected version matrix.
   • Once a vendor fix is released, inventory all ColdFusion instances, identify the affected version range, and prioritize internet-facing deployments for emergency patching.

3. Long-term hardening:

   • Apply the principle of least privilege to the ColdFusion service account to limit post-exploitation reach.
   • Implement file upload allowlisting as a standard secure-coding control (mapped to CWE-434 guidance).
   • Add continuous monitoring and alerting for file creation events involving executable extensions in web-accessible directories.
   • Maintain an SBOM/asset inventory for web platforms at the network edge to accelerate future emergency response.

References

• NVD — CVE-2026-105899: https://nvd.nist.gov/vuln/detail/CVE-2026-105899
• MITRE CWE-434 — Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Adobe ColdFusion Security Advisories: https://helpx.adobe.com/security/products/coldfusion.html
• FIRST EPSS — CVE-2026-105899 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-105899

Note: No evidence of active exploitation, threat actor campaign, public PoC, or CISA KEV listing is present in the supplied intelligence data for CVE-2026-105899.