ColdFusion 2016 Update 4, ColdFusion 11 Update 12 and ColdFusion 10 Update 23 released

This post is to announce the release of the following ColdFusion updates:

ColdFusion 2016 Update 4

ColdFusion 2016 Update 4 upgrades Tomcat to version and fixes 115 bugs (including 52 external bugs) in areas such as Security, Language, Charting and Performance. This update also addresses vulnerabilities mentioned in the security bulletin APSB17-14.  For details and instructions on how to apply this update refer this technote.

ColdFusion 11 Update 12

ColdFusion 11 Update 12 upgrades Tomcat to version 7.0.75. It also addresses vulnerabilities mentioned in the security bulletin APSB17-14 and fixes 59 bugs (including 28 external bugs) related to areas such as AJAX, Charting and Language. For details and instructions on how to apply this update refer this technote.

ColdFusion 10 Update 23

ColdFusion 10 Update 23 upgrades Tomcat version to 7.0.75. This update addresses vulnerabilities mentioned in the security bulletin APSB17-14 and includes a total of 17 bug fixes (including 7 external bugs) related to Language, Charting, Scheduler, Document Management and certain other areas. For details and instructions on how to apply this update refer this technote.

The build number after applying thse updates should be:

2106,0,4,302561 for ColdFusion 2016;
11,0,12,302575 for ColdFusion 11.
10,0,23,302580 for ColdFusion 10.


  • Support for Windows Server 2016 will be introduced with the refreshed full ColdFusion 2016 server installer which will be made available shortly. Update: The new installer is now available, as of Apr 28.
  • The core support for ColdFusion 10 effectively ends on May 16, 2017. It will, therefore, receive no further updates. For detailed support timelines, see this EOL matrix.



39 Responses

  1. Please can you update the full download of CF Ent to update 4? i.e. the “trial” version at I need to install it on a new Win 2016 server. Thanks.

  2. Anyone else having issues with CF11 Update 12 failing to install via the updater page? I tried updating my test systems today Update 12 won’t install. The CFAdmin Update page goes through the motions to download and install. The updater will stop all CF 11 related services, it will restart all CF 11 related services EXCEPT the main CFUSION instance.

    Developer Edition CF11 with Update 11. Windows 7 and Windows 10. Those are the only two I’ve tried so far. CF is running as the Local System account on both.

  3. Phill,
    Update 4 for ColdFusion Builder 2016, should be out sometime next month.

    The full installer for ColdFusion server 2016 would be refreshed towards the end of this month. This new installer would work on Windows Server 2016 and would have Update 3, pre-bundled.

  4. Wil,
    First of all, please check to see if the update was installed successfully. You can check the update install log at /cfusion/hf-updates directory, for errors.
    Did you try to start the cfusion instance manually, post update install?
    Can you check the coldfusion start-up log (coldfusion-out.log) at /cfusion/logs/ for start-up related errors? Alternatively, you can start CF from the windows command console, by running the command: /cufison/bin/cfstart.bat. CF will log everything, including errors, upfront, in the console.

  5. I tried to install the Update via cfadmin and it did not work. I browsed my file system and found the installed update in folder
    while my Coldfusion installation resides on drive d:

    The generated log file starts with
    Command Line Args:
    0: -i
    1: silent
    2: -f
    3: D:ColdFusion11cfusionhf-updates/



    The properties file says

  6. Wil,

    We had the same problem on our staging server. What caught my attention was that it said “error” in the progress bar as soon as I clicked it.

    It turns out that someone had updated the Java client from 1.8.0_111 to 1.8.0_131 and that deletes the contents from the 111 directory. The CF server was still running because it had already loaded Java but anything that needed to invoke it again (like the download or installation of the hotfix) failed.

    We stopped the CF Application service and updated the line in //cfsuion/bin/jvm.config to point to the new jvm location and started CF again. After that, it worked just fine.

    Hope this helps.

  7. @Charlie, the new installer is preconfigured with Update 3. One of the reasons was to maintain consistency in the installers across all platforms. More importantly, releasing the installer with Update 4 would have meant a delayed release for the new installers which we did not want since we know a lot of users are looking forward to these installers.

  8. @David: It’s not the Java install. Mine are intact. I never use the default system Java. I keep multiple and separate Java installs on my test systems for the purposes of testing.

    @piyush: I already checked that’s why I posted a comment here.

    More info. The Update 12 jar file downloads. It unpacks. The backup folders to rollback the update gets created in the wrong location. Now its created at .coldfusion11hf-updates instead of at .coldfusion11[instance name]hf-updates. The ever critical updates.xml file never get updated. With two instances running the CFUSION instance will be stopped and never restarted. The second instance never gets stopped. The install log shows the jar unpacked to the temp location, but the files are never copied to the ColdFusion folder.

    Same exact behavior on two different systems.

  9. @charlie You understand correctly. The only contents of c:coldfusion11 were the updates 11 and 12. It came into my mind the updater 11 had failed but I had not looked into the problem at that time. I simply installed the update via command line. The coldFusion administrator did download the updater jar file into the correct location on my d: drive. It was extracted into the wrong location.
    I filed a finding some times ago: The version number of the installation is not correct. The build number is not increased:
    The adobe people beleive this is an issue of a corrupt install.
    When I installed the update on command line a UI popped up asking for the location. The input filed was preset to c:coldfusion11. I take it this is the default install location. I assume the configuration of my install somwhere deep down believes it resides in the default location on the c: drive.

  10. Bernhard,
    We’ve have made a change in our hosted resources. Can you please try running update 12 from the ColdFusion administrator again. Pls. clear your browser’s cache before attempting the update again.

    Can you please share the absolute path of your ColdFusion installation.
    You’ve mentioned that “.coldfusion11hf-updates” gets created. Can you share the “” file with us. you can mail it to me at
    In light of the change mentioned in my note for Bernhard above, can you also try the update process again.

  11. Piyush,

    Thank you for responding. I’ve sent you awn email with the information you requested. I’ve also tried the installs again per your request. The results thus far are as follows: I made sure the CF Admin updates page downloaded new jar files.

    macOS: Failed same as before

    Win7: “Failed” differently, but worked. The install appears to have put the install and uninstall files in the correct location. All CF11 services were stopped and eventually restarted. The Progress Information window in the CFAdmin never updated. Even after 15 minutes. I manually refreshed the CFAdmin page, logged back in and the update confirms it was installed.

    Win10: “Failed” differently, but worked. The install appears to have put the install and uninstall files in the correct location. All CF11 services were stopped and eventually restarted. The Progress Information window in the CFAdmin never updated. Even after 15 minutes. I manually refreshed the CFAdmin page, logged back in and the update confirms it was installed.


  12. I am now restoring both of our CF 2016 servers after trying to install the CF2016 update 4 from earlier today. we clicked on the download and install button in the administrator (which usually works) and it trashed both of our machines.

    here is the error message from the admin page (which crashes with an internal CF error)

    The isAdminClientCertAuthEnabled method was not found.

    Either there are no methods with the specified method name and argument types or the isAdminClientCertAuthEnabled method is overloaded with argument types that ColdFusion cannot decipher reliably. ColdFusion found 0 methods that match the provided arguments. If this is a Java object and you verified that the method exists, use the javacast function to reduce ambiguity.

    The error occurred in Application.cfm: line 214
    Called from Application.cfm: line 173
    Called from Application.cfm: line 1

    -1 : Unable to display error’s location in a CFML template.

    stopping and starting the CF services doesn’t work, as the main service CF application refuses to start. I’ve been on hold for over an hour with adobe support waiting to talk to an engineer, so I think it is safe to say I am not the only person who is having problems.


  13. I am running Coldbox 4.3. I updated to Coldfusion 2016 Update 4 on my local today. It broke my ajax functions on multiple sites. An example is:

    This was working before the update:

    Now I get this error:
    The FIRST_NAME parameter to the saveDataEntryCanSupProxy function is required but was not passed in.

    And this is the params from chrome. the first_name is in the arguments.

    And when I run just the URL to the proxy it works fine. So it has something to do with the reading of the arguments

    Not sure if this is a Coldbox bug or CF2016. But the fact it started happening right when I updated makes me think it is the update. Anyone have any ideas or experiencing this? Thanks!

  14. @Michael, I’ve updated five different CF2016 systems yesterday and today (dev, staging, and production) on multiple OSes including Win7, Win10, Win2012R2 server, MacOS, Ubuntu Linux AMI. I have not seen any issues with the update process for CF2016. There could be another issue that is causing a problem. If ColdFusion isn’t even starting make sure your Java install is still good. See previous comments about that and really read what Charlie wrote.

    @Charlie: Sage advice as always.

  15. Hi Michael,

    Can you share the update log file located at hf-updateshf-2016-00004-302561.
    Can you let us know, what are the jars are present in update directory located at libupdates?
    Did you restart the server manually to check, if the server is coming up? if not,can you try installing the update manually from command line, using Java -jar hf-updateshotfix-004-302561.jar and see if it works?

  16. Wil,

    Could you try to click on ‘Check for Updates’ a couple of time again, and attempt to re-download the application. We believe the XML file has been cached on your machine.

    And if that doesn’t work, please provide the following details,
    – ColdFusion Installation Directory
    – The properties file ‘’ from /cfusion/hf_updates/

  17. @HariKrishna Kallae — I have the log file, what email address should I send it to?

    1141 Successes
    0 Warnings
    3 NonFatalErrors
    4 FatalErrors

    Moving files failed:
    Status: FATAL ERROR
    Additional Notes: FATAL ERROR – Could not move the file D:ColdFusion2016cfusionlibupdateschf20160003.jar to the backup location D:ColdFusion2016cfusionhf-updateshf-2016-00004-302561backuplibupdateschf20160003.jar

    Moving files failed:
    Status: FATAL ERROR
    Additional Notes: FATAL ERROR – Could not move the file D:ColdFusion2016cfusion/runtime/lib/ecj-4.4.2.jar to the backup location D:ColdFusion2016cfusionhf-updateshf-2016-00004-302561backup/runtime/lib/ecj-4.4.2.jar

    Moving files failed:
    Status: FATAL ERROR
    Additional Notes: FATAL ERROR – Could not move the file D:ColdFusion2016cfusion/lib/nekohtml-1.9.16.jar to the backup location D:ColdFusion2016cfusionhf-updateshf-2016-00004-302561backup/lib/nekohtml-1.9.16.jar

    Moving files failed:
    Status: FATAL ERROR
    Additional Notes: FATAL ERROR – Could not move the file D:ColdFusion2016cfusion/lib/antisamy-1.5.3.jar to the backup location D:ColdFusion2016cfusionhf-updateshf-2016-00004-302561backup/lib/antisamy-1.5.3.jar

    in libupdates there are 2 JAR files chf2016003.jar and chf20160004.jar

    I tried uninstalling the update, that failed.
    I also tried installing the update again manually and that also made no difference.
    rebooting the server did not help, the main service would not start.


  18. @Charlie, I did in fact read your article. it was helpful in pointing me to look in the right places for the log files and options to try to save the servers.

    since my servers are virtual machines, and a full backup was done to them the day before
    it was much easier for me to just roll them back to before the update was attempted.

    my suggestion to Adobe is to get rid of the install update button in the CF admin.
    even if it fails in a small percentage of cases, if there is a chance of trashing a server with it, then it doesn’t belong in the admin panel.


  19. @charlie – thank you for the reply. I did check that the update took:
    Installed Feature(s) Standard, J2EE of Adobe ColdFusion 2016 Update 4
    Install Begin: APRIL 27, 2017 9:03:25 AM CDT
    Install End: APRIL 27, 2017 9:04:17 AM CDT
    Installed by InstallAnywhere 18.0 Premier Build 5460

    User Interactions
    Installation: Successful.

    1999 Successes
    0 Warnings
    0 NonFatalErrors
    0 FatalErrors

    As I mentioned it is across websites so I know it is not a code issue. Something got flipped or changed in the update that now is not playing nice with Coldbox proxy. When I call the URL that the proxy is calling from another tab, it works great. But run through CF it is giving me the parameter missing error. I will keep troubleshooting…just wondering if anyone else had this issue.

  20. @Charlie once again I appreciate your time! I have done the updates in order and just to make sure tried the upgrade and also just removing and readding the connectors for the site I am using. I am getting the same issue. I did have more time and have figured out a little deeper what is going on. I have ruled out it being a Coldbox issue.

    I setup my site running CF2016 and then CF10 and ran the same calls using the same codebase to both catching what is getting passed in the application.cfc “onCFCRequest” function. I just returned the arguments being passed into that method.

    Results from CF2016

    Results from CF10
    “collat_taxes_current_status”:”Not Checked”,

    The arguments do not contain what is being passed in. The form data in the request Chrome network tab is identical.
    So somewhere between the data being handled by CF and it invoking the CFC the arguments are being dropped. Strange.

  21. Hi Michael,

    Thanks for providing the FATAL errors in the log. So, it’s clear from the errors that the server did not stop completely before the update was applied, hence it couldn’t backup the jar files.

    Now, to make your main instance work, stop/kill all the CF process from Task Manager and try installing the update manually from command-line, using D:ColdFusion2016jrebinjava.exe -jar hf-updateshotfix-004-302561.jar, this should resolve the issue.

    Let me know, if you have any issues in applying the update manually?


  22. Matt,
    In the code snippet you’ve shared it is not clear what “oDataProx” is.
    Can you narrow the issue down to test code (something that can run outside the scope of your application) with which you can reproduce the issue.
    If not, can you share details like the workflow you are following when you observe the error and the CFMs and CFCs that are pertinent to your workflow. You can mail it to me at

  23. @Charlie I do have 2 sites setup through IIS and double checked that it was calling the correct files and it was. I have not had time to call the code through the built in webserver but I did uninstall update 4, did not touch the connectors after the uninstall, and now my code works great again. So I am surprised no one else has had this issue on their site.

    @piyush I will send you more information tomorrow AM

    Thank you,

  24. @Wil – Did you find any solution for the CF 11 update 12 issue?

    I just installed it on 4 of our 5 Cf11 instances (all running on Server 2012 R2) using the CfAdmin gui with no problem.

    The 5th machine always has issues when I use the CfAdmin giu so I do it manually using the instructions provide on the hotfix page ( For some reason this update seems to break the ColdFusion Windows service so it will not start. There is no error in the Cf logs and the error in the Windows Application logs contains no info.

    I made sure to check in Cf admin which java it was using (the install must use the same one as Cf). I navigated via CLI to that folder, stopped the Windows ColdFusion service, executed the hotfix file, and followed the install process. It says it completes successfully and a check of the install log shows no errors for anything (100% successful). When I go to start the Windows ColdFusion service it refuses to start. Running the uninstall via cli and removing the hotfix jar file resolves the issue so it is something with this hotfix. Cf may be able to start via the CLI but it needs to be running via the Windows Service.

    If you find a resolution please post it here.



  25. @Charlie @piyush @matt graff

    I am having a very similar issue and uninstalling update 4 resolves it; no other changes made.

    To recap; updated CF2016 to Update4 now coldfusion is throwing an error back at me whenever is submit via Ajax; Downgrade to Update3 and it is fine.

    “The CONTACTID parameter to the UpdateContact function is required but was not passed in.”

    Did anybody get to the bottom of this issue?

  26. Charles, since you say the problem occurs “whenever” you “submit via ajax”, can you take a moment and create simple standalone example that demonstrates the problem? That’s always the best way to get a problem fixed, as then others (especially Adobe) can confirm seeing it and more readily then discern the exact internal problem.

    It only needs to be one page (or two if you prefer) reflecting how you’re creating the ajax call, what you’re passing, and what should receive it. You can used fixed values rather than make it based on variable input.

    It need not take more than several lines total and perhaps a few minutes to create, knowing what you do about your specific problem. Even if you may argue that you don’t want to apply update 4 to prove that it fails, any of us who have it could confirm for you if it does.

    Of course, the best situation would be if you confirmed that your example worked on u3 and then failed on u4. Then if any of us couldn’t replicate the problem on u4, it would indicate something unique on your end (which may explain why we don’t hear of large-scale suffering of this). Or we may find that we can all demonstrate it, which should then help Adobe more quickly resolve it.

    Or maybe they’ll write back saying that they are already aware of it. But they didn’t respond overnight, so it’s your call as to whether you really want to wait to hear from them or proceed with such a proof case.

  27. @Charles, you never wrote back. Had you since solved your problem?

    If not, here’s possibly good news: I learned while working with someone else that there is indeed a fix for this problem, or at least it sounds exactly like your problem. See this Adobe bug report to confirm and especially for the available bugfix jar (which you would implement until Adobe comes out with the next major update to include it):

    Let us know how it goes.

  28. Can you tell us when “ColdFusion (2016 release) Update 5” will be released? They are generally 4-7 months apart and I’m curious if the release date can be given to us so we know.

    Hard to plan in the dark…

Leave a reply