# CVE-2026-80235: Thinking Software Technology EFence arbitrary file upload

Source: https://junglewise.ai/threats/cve-2026-80235-thinking-software-technology-efence-arbitrary-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80235 · Severity: critical · CVSS 9.8 · Published 2026-08-26

EFence is a web application security tool used to protect and monitor enterprise servers. An unauthenticated attacker can bypass security controls and upload malicious web shell files, leading to complete compromise of the server and arbitrary code execution. This allows attackers to take full control of the system, steal data, and establish persistent backdoor access without requiring any credentials.

Technologies: [Thinking Software Technology EFence](https://junglewise.ai/threats/technologies/efence). Vendors: [Thinking Software Technology](https://junglewise.ai/threats/vendors/thinking-software-technology).

## Quick answers

**Is CVE-2026-80235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80235 being exploited in the wild.

**How severe is CVE-2026-80235?** Critical severity, with a CVSS score of 9.8, published 26 August 2026.

**Which products and versions are affected?** Thinking Software Technology EFence 1.2.66 DB Ver:56 and earlier.

**Is there a fix for CVE-2026-80235?** A patch was published on 2026-08-26: Fix available in version 1.2.67 DB Ver:57 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80235 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-80235?** Check whether you run Thinking Software Technology EFence at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-80235 is an arbitrary file upload vulnerability in EFence version 1.2.66 and earlier that allows unauthenticated remote attackers to upload and execute web shell backdoors. The vulnerability exists due to insufficient validation of uploaded files and lacks proper authentication checks on the upload endpoint. Attack vector is network-based with no authentication required, no user interaction needed, and no complexity barriers (CVSS vector AV:N/AC:L/PR:N/UI:N). Successful exploitation results in arbitrary code execution on the server with full system compromise. A patch is available in version 1.2.67 DB Ver:57 and later.

## Affected products

- Thinking Software Technology EFence 1.2.66 DB Ver:56 and earlier

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Fix available in version 1.2.67 DB Ver:57 and later

## References

- [https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html](https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html](https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html)

## Related threats

- [Thinking Software Technology EFence SQL injection](https://junglewise.ai/threats/cve-2026-89180-thinking-software-technology-efence-sql-injection)
- [Thinking Software Technology EFence arbitrary file upload](https://junglewise.ai/threats/cve-2026-80237-thinking-software-technology-efence-arbitrary-file-upload)
- [Thinking Software Technology EFence SQL injection](https://junglewise.ai/threats/cve-2026-80236-thinking-software-technology-efence-sql-injection)