-
Close Search
NOW LIVE — the September 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. The updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure. What’s included The September 2026 release contains: SQL table and stored-procedure identifier validation New SQL validation opt-out flags XSLT collection() and uri-collection() blocked New XSLT compatibility flag AJAX widget HTML input sanitization guidance Configurable deserialization limits Package updates Download the updates ColdFusion […]
Adobe has released ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. The releases resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.View the security bulletin, APSB26-82, for more information. Download the updates ColdFusion 2025 updates ColdFusion 2023 updates What’s newThis update introduces the flag -Dcoldfusion.sql.allowUnsafeTableIdentifiers. The default is False. Updates to Performance Monitoring Toolset for both CF 2025 and CF 2023. Updated add-on installers Bug fixes View […]
Adobe has released ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The releases introduce some important advancements that reinforce a clear direction: secure-by-default behavior, tighter control, and better developer governance. Find this and other updates here: ColdFusion 2025 updates ColdFusion 2023 updates This update focuses heavily on addressing critical security concerns while also giving developers more control over how their applications interact with external systems, attachments, and XML processing. Security fixes and cumulative patching Both updates address multiple vulnerabilities that could result in […]
NOW LIVE — the June 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass. What’s included The June 2026 release contains: Tomcat upgrades. See the respective tech notes for more details. Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors). Patches to harden request handling, deserialization paths, […]
NOW LIVE — the April 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update addresses multiple security issues and includes important mitigations we recommend you apply as soon as possible. What’s included The April 2026 release contains: Tomcat upgrades. See the respective tech notes for more details. Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors). Patches to harden request handling, deserialization paths, and template parsing logic. Updates to packages. Why […]
We are pleased to inform you that we’ve released security updates for ColdFusion 2025 and 2023 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 6 ColdFusion (2023 release) Update 18 What’s new and changed The releases address CVE-2025-66516, a critical XXE in Apache Tika libraries. Adobe strongly recommends that you apply this update as soon as possible. Note that this update is cumulative and includes fixes from previous updates.This update upgrades the embedded Apache Tika […]
We are pleased to inform you that we’ve released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 5 ColdFusion (2023 release) Update 17 ColdFusion (2021 release) Update 23 The updates includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The updates also include: New JVM flags Changes to serialfilter CAR migration changes […]
We are pleased to inform you that we’ve released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 4 ColdFusion (2023 release) Update 16 ColdFusion (2021 release) Update 22 The updates address an important security fix related to critical path traversal.View the security bulletin, APSB25-93, for more information.Download the updates ColdFusion 2025 updates ColdFusion 2023 updates ColdFusion 2021 updates Docker and CFFiddle CFFiddle is now updated with the changes […]
We are pleased to inform you that we’ve released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 3 ColdFusion (2023 release) Update 15 ColdFusion (2021 release) Update 21 The updates include a newer version of Tomcat, important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass. View the security bulletin, APSB25-69, for more information.Download the updates ColdFusion 2025 updates ColdFusion […]
We are pleased to inform you that we’ve released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 1 ColdFusion (2023 release) Update 13 ColdFusion (2021 release) Update 19 These updates resolve several critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution, and security feature bypass. View the security bulletin, APSB25-15, for more information. Download the updates ColdFusion 2025 updates ColdFusion 2023 updates ColdFusion 2021 […]
We have released critical security updates for ColdFusion (2023 release) and ColdFusion (2021 release). Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read. View the security bulletin, APSB24-107, and the tech notes for more information. Download the updates from the following locations: ColdFusion (2023 release) Updates ColdFusion (2021 release) Updates For more information, view the following tech notes: ColdFusion (2023 release) Update 12 ColdFusion (2021 release) Update 18 Known issues in the updates […]
[Update 13 Dec]: Added cfencode.sh to the table of removals. Updated Customizing an HTTP response to HTTP reason phrases. Added contact email id cf-deprecation@adobe.com In the upcoming ColdFusion (2025 release), we will deprecate and remove certain features to enhance the overall experience, improve security, stay aligned with the latest technological advancements, and eliminate obsolete libraries. We announced the deprecations and removals on the ColdFusion pre-release forum a few days ago. If you haven’t already signed up, please do so today As part of this exercise, […]
