CVE-2019-7816: Adobe ColdFusion file upload restriction bypass allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and arbitrary code execution impact, plus very high EPSS, warrants critical priority despite no KEV listing.

What it is

Adobe ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier contain a file upload restriction bypass (CWE-434). An attacker can upload a file that bypasses intended restrictions, and successful exploitation could lead to arbitrary code execution. The flaw is remotely reachable with no authentication or user interaction, making it a serious risk to exposed ColdFusion servers.

Impact

An attacker gains the ability to execute arbitrary code on the ColdFusion server, which typically runs with the privileges of the ColdFusion service account. This can lead to full server compromise, data theft, or use of the host as a pivot point.

Attack surface

The vulnerability is network-reachable (AV:N) with low complexity and no privileges or user interaction required (PR:N, UI:N), so it can be triggered by sending crafted upload requests directly to the ColdFusion service. No authentication is needed based on the CVSS vector.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.676 (99.3rd percentile), indicating a strong likelihood of exploitation activity. The only references are Adobe vendor advisories, with no public exploit or in-the-wild reporting tags provided.

What to do

• Apply the Adobe ColdFusion security update referenced in advisory APSB19-14 for your ColdFusion version.
• Restrict network access to ColdFusion administrative and upload endpoints to trusted hosts only.
• Enforce strict server-side file type, extension, and content validation on all upload paths.
• Run the ColdFusion service with least privilege and isolate it from sensitive internal systems.
• Monitor and alert on unexpected file writes to web-accessible directories.

Detection

• Monitor web server and ColdFusion logs for upload requests with unusual file extensions or content types.
• Alert on new executable or script files appearing in web-accessible directories.
• Look for unexpected child processes spawned by the ColdFusion service (e.g., cmd.exe, powershell, /bin/sh).
• Review file integrity monitoring alerts for changes to ColdFusion webroot files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.