Community Manager

Blog

Adobe ColdFusion (2023 Release) Update 25 is here

Forum|Forum|17 hours ago
September 23, 2026
3 replies
54 views

We’re excited to announce the availability of Adobe ColdFusion (2023 Release) Update 25, a significant update focused on platform modernization, developer productivity, improved compatibility, and important bug fixes across the server, Administrator, packages, and integrations.

The update also includes extensive OEM library upgrades, Query-of-Queries enhancements, metadata handling improvements, spread operator fixes, and updates to several ColdFusion packages.

Download the update

View the tech note

Release highlights

OEM upgrades

One of the biggest highlights in this release is the update of numerous underlying libraries and frameworks that power ColdFusion. Update 25 includes major upgrades to components such as:

Apache Maven 3.9.16
Log4j 2.25.4
Jetty 9.4.58
jQuery 3.7.1
Apache Tika 2.9.4
Commons libraries
Netty components
CXF services framework

These upgrades help improve compatibility, stability, maintainability, and overall platform security.

Query-of-Queries Enhancements

Developers who rely on Query-of-Queries (QoQ) will benefit from several important improvements.

Consistent NULL Evaluation for Varchar Columns

Previously, QoQ operations could return inconsistent results when evaluating IS NULL and IS NOT NULL predicates against varchar columns. The behavior could differ between varchar and numeric data types even when both contained equivalent NULL values.

Update 25 now provides:

Consistent NULL handling across varchar and integer columns
Reliable IS NULL filtering
Reliable IS NOT NULL filtering
Consistent behavior regardless of ColdFusion null support settings

This results in more predictable query processing and reduces edge-case issues in data-driven applications.

Improved Query Sorting Metadata

A long-standing edge case could cause datatype metadata corruption when sorting Query-of-Queries using fully qualified column names and subsequently adding new columns through queryAddColumn().

Update 25 preserves column type metadata correctly after sorting operations, ensuring that newly added varchar columns remain varchar and preventing DataTypeMismatchException errors.

Better Query Metadata Preservation

querySlice() Now Retains Column Types

Developers using querySlice() may have noticed that sliced queries occasionally lost original column type metadata.

For example:

Integer columns could lose integer metadata
Varchar columns could lose varchar metadata

With Update 25, the returned query now preserves the original query's metadata, making serialization, type-sensitive processing, and framework integrations more reliable. Existing code requires no modifications to take advantage of the enhancement.

...and a lot more.. View the tech notes for more information.

We strongly recommend that all ColdFusion 2023 customers upgrade to Update 25 and review the latest security guidance and Lockdown recommendations as part of their update process.

Have questions about Update 25 or have feedback after upgrading? Join the discussion here on the Adobe ColdFusion Community Forum and let us know your experience.

Charlie Arehart

Community Expert

If it may help readers, I want to share here some thoughts/observations which I’d offered also this morning on the Adobe CF Portal post about the update (https://coldfusion.adobe.com/2026/09/adobe-coldfusion-2023-release-update-25-is-here/):

First, some will want to hear that no, there is no corresponding update released today for CF2025. In fact, much of what is in this update are things that were released on CF2025’s update 8. (Some will recall that when THAT update came out, there was also no corresponding update to CF2023.)
As a demonstration of that previous point, one can see that most of the “bugs fixed” listed in this update’s technote (linked to above) are in fact the same bugs listed as “bug fixes” in the CF2025 update 8 release notes. (There’s not a perfect match, but a very high correlation.)
That said, while update 8 of CF2025 had added MANY new features (AI and much more), you can see from the post above that this update has only a few feature changes (beyond the many library updates and bug fixes). So it’s NOT accurate to conclude that “this update brings CF2023 in line with CF2025 functionality”, but it does bring it “a bit more in line”.
It’s curious to see that while this post has a bit more info on these few qofq changes (null handling, sorting, queryslice/metadata), that same info is NOT offered in the cf2023 update 25 update technote. It merely mentions those words, not the additional detail offered here. It’s unfortunate that people seeing only the update technote won’t really be able to discern the changes unless they find this post.
Then again, this post currently ends that list of changes saying “…and a lot more” and pointing us to the update technote. But it only has “more” about bugs fixed, as far as I can tell. Again it has LESS detail about feature changes than this post.
FWIW, the update technote does indicate that 33 of the CF packages/modules are upgraded in this update.
Finally, if anyone may conclude that it seems this update “has no security fixes for CF” (based on the indicated changes), that’s not quite accurate. Note how the post above says (after the list of upgrades to the various Java libraries that CF embeds): “These upgrades help improve compatibility, stability, maintainability, and overall platform security.” So this is indeed a “security update”, by that assocation.

It will be interesting to hear what other ramifications may come from folks applying the update. I don’t recall hearing much about the listed things when CF2025 update 8 was released, so hopefully this one goes smoothly for most folks.

Of course, if you may be skipping to update 25 from an update earlier than 24, then you do need to be aware of the changes brought by update 24 and any others you may have skipped. Those updates DID introduce sometimes-breaking changes, for the sake of security–and generally they offered an optional JVM arg that could be used to revert such changed behavior, to aid in migration (though such jvm args should not be relied on permanently, as they do revert improvements intended to increase security.)

/Charlie (troubleshooter, carehart. org)

S

Simranjit Singh

Participating Frequently

I installed this update on our CF2023 developer and some of the packages including cfadmin were uninstalled. I was able to use cfpm.bat to re-install and get it all working again. This has never happened before and I used our standard workflow to install the update.
I’ve also created a post

Charlie Arehart

Community Expert

Simranjit, this actually does happen to people (in about every update), for various different reasons. It’s as often not a bug in the update but some unexpected error in the process of applying it. I realize that’s of little consolation for you, but I say this to convey to other readers that they should not necessarily expect to experience what you did.

FWIW, I have applied today’s update on many machines, different operating systems, and both using the admin as well as using the manual offline command-line install approach (on a disconnected server). I did not experience the error you did. I hope to have time to look into your other thread, perhaps tomorrow. It’s been a very long day, so I need to call it a night.