Today, we’re excited to announce that Adobe ColdFusion 2025 Update 8 is generally available. The full installers also add support for Windows Server 2025. 

This release is a milestone. It turns ColdFusion into a complete, enterprise-ready platform for building AI-driven applications — natively, without rewrites, without standing up a separate Python stack, and without locking you into a single AI vendor. And while AI is the headline, we’ve also shipped a major security uplift, a meaningful set of language improvements, performance gains, and platform updates that the community has been asking for. 

Here’s what’s now in your hands. 

AI, built into the platform 

Every CIO, CTO, and engineering lead has been answering the same question this year: “What’s our AI strategy?” The pressure is real — but so is the constraint. You can’t throw out the applications running your business just to bolt on a chatbot. You need AI to live where your business logic already lives. 

That’s what this release delivers. The AI plumbing that most teams spend two quarters assembling is now part of ColdFusion itself. Models, document processing, vector search, retrieval, guardrails, agent connectivity — all native, all callable from CFML, all governed by the same security and operational model you already trust. 

A vendor-neutral framework for large language models 

ColdFusion 2025 Update 8 ships with built-in support for every major LLM provider: OpenAI, Anthropic, Google Gemini, Mistral AI, Azure OpenAI, and Ollama for local or fully offline inference. Switching providers is a configuration change — not a refactor. Route sensitive workloads to a local model running inside your own infrastructure, use a frontier model for general tasks, and rebalance as pricing or capabilities shift in the market. 

Under the hood, you get the controls a serious AI integration needs: full ChatModelConfig over temperature, token limits, top-P and top-K, seed, timeouts, and Anthropic’s extended thinking mode. Conversation memory is per-user and persistent, backed by Redis, Memcache, or Ehcache. Function tools let the model call your CFML code. Token streaming makes responses feel instant — the way users now expect modern AI to behave — and structured JSON output makes results directly consumable by the rest of your application, no fragile text parsing required. 

Retrieval Augmented Generation in a single function call 

If hallucinations are the biggest enterprise objection to AI, RAG is the standard defense — and ColdFusion now has it built in. The new simpleRAG(source, model, options) function gives you a complete pipeline in one call: document loading, chunking, embedding, vector storage, retrieval, and generation. Supported formats span PDF, DOCX, TXT, MD, HTML, XML, CSV, JSON, EPUB, and Office documents. 

Query the pipeline with ask() for single-turn questions or chat() for multi-turn conversations. For large corpora, ingestAsync() handles ingestion in the background so you’re not blocking on a one-time load. And when you need finer control, the standalone documentService() exposes the underlying load, split, and transform stages for custom pipelines. 

The result: AI answers grounded in your real documents, your real policies, your real product data — not generic internet knowledge. 

A unified VectorStore API 

Semantic search — finding what users mean, not just what they typed — used to require standing up an entirely separate data stack. Not anymore. The new VectorStore() built-in function provides a single API across InMemory, Milvus, Pinecone, Qdrant, and Chroma. Configure your embedding model once, then work in plain text: the framework handles the vectors for you. 

You get full collection management, metadata filtering, Top-K retrieval with score thresholds, and a typed VectorStoreException hierarchy so errors are something you can actually program against. A search for “warm footwear” finally returns winter boots, inside the application you already have. 

Model Context Protocol — as a client and a server 

Model Context Protocol (MCP) is the emerging standard for how AI agents and business applications talk to each other. ColdFusion 2025 Update 8 supports both sides of that conversation. 

As an MCP client, your application can connect to any MCP-compatible server over HTTP or STDIO, with automatic capability handshake. Discover and call external tools with listTools() and callTool(), pull read-only data with listResources() and readResource(), and reuse prompt templates with listPrompts() and getPrompt(). 

As an MCP server, you can expose your own CFCs, prompts, and resources to any MCP host — Claude Desktop, Cursor, in-house agents, anything that speaks the protocol. Only remote CFC methods are exposed; parameters become tool arguments automatically. And here’s the elegant part: CFC methods you’ve already registered as LLM function tools are automatically available as MCP-callable tools too. One registration, both integration patterns. 

This is what turns a decade-old ColdFusion application into an active participant in the modern AI ecosystem — not a passive data store, but a callable agent that AI workflows can actually use. 

AI Guardrails 

Production AI needs guardrails, not just good intentions. The new CFC-based input/output validation pipeline lets you detect prompt injection, redact PII, block harmful content, and enforce compliance rules — all before a response reaches a user or a downstream system. Outcomes are explicit: success, successWith (rewrite the message), failure, and fatal. Governance becomes code, not policy doc. 

Operational visibility through PMT 

The Performance Monitoring Toolset adds a new AI Services dashboard covering Agents, LLMs, vector stores, RAG pipelines, and both sides of MCP. Response times, throughput, status and operation distribution, per-instance filtering — the operational telemetry an enterprise team needs to run AI in production, not just demo it. 

Security: a major uplift 

AI gets the headlines, but security is what lets the headlines ship. This release tightens the platform end to end. 

Passkey authentication 

Passkey authentication brings passwordless login via WebAuthn and FIDO2, with built-in challenge management, CSRF protection, and secure credential storage. Your users get a sign-in experience that matches what they already use on consumer apps and devices — and your security team gets an authentication model that’s resistant to phishing by design. 

Argon2 password hashing 

Argon2 password hashing is now first-class through generateArgon2Hash() and verifyArgon2Hash(), with configurable memory cost, CPU iterations, and parallelism — the current best practice for credential storage. 

The new CF Security Analyzer brings static analysis into the development loop, flagging vulnerabilities in CFML code before they reach production. And across the platform, you’ll find proactive hardening in authentication flows, session handling, and privilege boundaries. 

Get started today 

ColdFusion 2025 Update 8 is available right now, as both a full installer and a hotfix installer. Existing customers can upgrade through the usual channels. Teams new to ColdFusion can download the free Developer Edition and explore every capability in this release locally. 

If you’ve been waiting for the right moment to bring AI into the applications running your business, that moment is here. Pick one workflow, prove it in 30 days, and let the platform do the heavy lifting. 

Already building something with the new AI features? We’d love to hear about it. Please drop in an email to adobecoldfusion@adobe.com.