After some more brainstorming with our IT-guys I tried something WILD - setting FULL CONTROL on the Windows system account Lucee runs under - and hey, now uploading works! Presumably all other security settings but Full Control on the /Lucee folder (where the webcontexts run) are inadequate for file uploading and file moving / copying. We now finally have a fully working MASA CMS running multiple sites on the latest stable build of Lucee 6! 🙂