-
Close Search
Staff
19 posts
NOW LIVE — the October 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass.
What’s included
The October 2026 release contains:
- Tomcat upgrades. See the respective tech notes for more details.
- Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors).
- Updates to packages.
Why you should install this update
These fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.
Download the updates
See the tech notes
Feedback and support
As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.
Thanks,
Team ColdFusion
NOW LIVE — the October 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass.
What’s included
The October 2026 release contains:
- Tomcat upgrades. See the respective tech notes for more details.
- Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors).
- Updates to packages.
Why you should install this update
These fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.
Download the updates
See the tech notes
Feedback and support
As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.
Thanks,
Team ColdFusion
You must be logged in to post a comment.
- Most Recent
- Most Relevant
I’ll also share that after doing each update (for cf2025 and cf2023), I found in my coldfusion-out.log that the very first line reported on startup was this error:
Cannot invoke "coldfusion.util.PasswordUtils.getSeedValue()" because the return value of "coldfusion.util.PasswordUtils.getInstance()" is null
But good news is that after restarting CF (in each case), the error did not appear again (and that was whether I HAD or HAD NOT deleted the felix-cache or cfclasses folders after the update and before that restart).
So I’m not so much documenting this to “report a bug”, but just in the hopes that folks looking into might see that a mere CF restart may “make this problem go away”.
The wording above doesn’t do justtice to the significance of the updates, let alone the changes made (done for the sake of improved security, of course). The technotes show LOTS of things impacted.
People will want to read the technotes carefully to assess potential impact on their existing apps before applying the update.
