NOW LIVE — the September 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. The updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.

What’s included

The September 2026 release contains:

• SQL table and stored-procedure identifier validation
• New SQL validation opt-out flags
• XSLT collection() and uri-collection() blocked
• New XSLT compatibility flag
• AJAX widget HTML input sanitization guidance
• Configurable deserialization limits
• Package updates

Download the updates

• ColdFusion 2025 updates
• ColdFusion 2023 updates

See the tech notes

• ColdFusion (2025 release) Update 13
• ColdFusion (2023 release) Update 24

Feedback and support

As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.

Thanks,

Team ColdFusion