CVE-2026-80235: Thinking Software Technology｜EFence - Arbitrary File Upload

Published Aug 26, 2026

Updated

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected Software

1 affected component

EFence

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade EFence to a version that resolves this vulnerability.
Fixed in 1.2.67
Upgrade
Upgrade EFence to a version that resolves this vulnerability.
Patch DB Ver:57 or later

Event History

Aug 26, 2026

CVE Published

via MITRE·08:26 AM

Data Sourced

via MITRE·08:26 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker who can reach the affected EFence service may exploit it. No credentials or user interaction are required.

What is the likely impact of successful exploitation?

An attacker can upload and execute a web shell backdoor, resulting in arbitrary code execution on the EFence server. This can compromise the confidentiality, integrity, and availability of the affected system.