Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🔐 Adobe ColdFusion October cluster — 5 critical CVEs, peak CVSS 10.0. No exploits yet. That window is historically short. CVE-2026-105899 (10.0) — unrestricted upload RCE, no auth https://threataft.com/articles/adobe-coldfusion-october-2026-cluster-cve-2026-105899 #Adobe #ColdFusion #CyberSecurity #CVE #PatchTuesday
CVE-2026-75994 CVE-2026-90530 CVE-2026-105899 CVE-2026-105903 CVE-2026-106612 CVE-2026-106616 CVE-2026-106619 CVE-2026-106622 CVE-2026-106623 CVE-2026-106624 Security update available for Adobe ColdFusion APSB26-144 -- https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
#NØØT_Security_Alerts 🚨 #ALERT — ADOBE COLDFUSION CVSS 10.0: UNAUTHENTICATED FILE UPLOAD VULNERABILITY ENABLES CODE EXECUTION October 13, 2026 DISCLOSED BY: Adobe Security PRODUCT: Adobe ColdFusion CVE: CVE-2026-105899 SEVERITY: CRITICAL — CVSS 3.1: 10.0 WEAKNESS: CWE-434 — Unrestricted Upload of Dangerous File Types AFFECTED VERSIONS: Adobe ColdFusion 2025 Update 13. Adobe ColdFusion 2023 Update 25. Earlier installations should be assessed against Adobe’s official security bulletin. IMPACT: Insufficient restrictions on dangerous file uploads could allow attackers to execute arbitrary code on affected ColdFusion servers. EXPOSURE: Network-reachable vulnerable ColdFusion applications. Adobe’s CVSS assessment specifies no required authentication, low attack complexity and no user interaction. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL CODE EXECUTION VULNERABILITY. Adobe reports no known exploitation in the wild. No independently verified working public exploit has been established. Forensic triage: Investigate suspicious uploads, unexpected executable files in application directories, unauthorized modifications to ColdFusion applications and unusual child processes. Review web-server requests and ColdFusion logs for anomalous activity. Preserve suspicious files and associated logs before remediation. No confirmed CVE-specific malicious IOCs are available. URGENT ACTION: Upgrade immediately: ColdFusion 2025 → Update 14. ColdFusion 2023 → Update 26. Restrict access to unnecessary administrative interfaces. Apply Adobe’s ColdFusion security configuration and lockdown recommendations. Investigate potentially exposed servers before assuming compromise. SOURCE: https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html CONFIDENCE: HIGH — Adobe’s October 13 advisory confirms the vulnerability, affected versions, CVSS 10.0 assessment and fixed releases. Active exploitation remains unverified. #CyberSecurity #ThreatIntel #Adobe #ColdFusion #RCE #ApplicationSecurity