Adobe has released ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. The releases resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.
View the security bulletin, APSB26-82, for more information.

What’s new
This update introduces the flag -Dcoldfusion.sql.allowUnsafeTableIdentifiers. The default is False.

View the respective tech notes for more details.

Download the updates and validate them in your staging environment. If you encounter any regressions or unexpected behavior after upgrading, report them through the Adobe support channel or your standard issue-tracking process, including relevant logs and reproduction details.