High severity · published Aug 26, 2026
CVE-2026-80237
Thinking Software Technology｜Efence - Arbitrary File Upload
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Efence · Thinking Software Technology
through 1.2.66 DB Ver:56 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80237
www.twcert.org.tw
https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html
www.twcert.org.tw
https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html
More from Efence
9.8
CVE-2026-80235
Thinking Software Technology｜EFence - Arbitrary File Upload
8.2
CVE-2026-80236
Thinking Software Technology｜Efence - SQL Injection
7.5
CVE-2026-89180
Thinking Software Technology｜EFence - SQL Injection