---
cve: "CVE-2026-105899"
severity: "CRITICAL"
cvss: 10.0
epss: "1%"
vendor: "Adobe"
kev: false
exploited: false
published: "2026-10-13 21:17:29"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T11:52:42+01:00"
---

# CVE-2026-105899

> 10.0 CRITICAL

## Beschreibung

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

## CNA-Record (Kanon, cvelistV5)

- CNA: **adobe**
- State: PUBLISHED
- Stand: 2026-10-14 10:40:54
- CNA-CVSS: **10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-434** — Unrestricted Upload of File with Dangerous Type
  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)

## BSI-Hinweise (deutsch)

- [Adobe ColdFusion: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3945) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitskontrollen zu umgehen, Daten offenzulegen oder zu manipulieren und Denial-of-Service-Zustände zu verursachen.

## Referenzen

- <https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-105899/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_