Why must I have the Update 4 of ColdFusion (2018 release) or Update 11 of ColdFusion (2016 release) installed before updating to Update 5 or Update 12 respectively?

These are mandatory updates because the latest updates are now signed using a new code signing certificate and the code changes to check for the new signature were included in Update 4 (ColdFusion 2018) and Update 11 (ColdFusion 2016).

If you are not on the specified updates and try to apply the new updates using the ColdFusion Administrator, you’ll see the error, Signature Verification Failed, because the code will still be looking for an outdated signature.

As an alternative, you can download the hotfix jar file directly from the 2018 updates and 2016 updates pages, and apply the update manually.