Skip to main content
Community Manager
Saurav_GhoshCommunity Manager
Community Manager
September 23, 2026
Blog

Adobe ColdFusion (2023 Release) Update 25 is here

We’re excited to announce the availability of Adobe ColdFusion (2023 Release) Update 25, a significant update focused on platform modernization, developer productivity, improved compatibility, and important bug fixes across the server, Administrator, packages, and integrations.

The update also includes extensive OEM library upgrades, Query-of-Queries enhancements, metadata handling improvements, spread operator fixes, and updates to several ColdFusion packages.

Download the update

 

View the tech note

 

Release highlights

OEM upgrades

One of the biggest highlights in this release is the update of numerous underlying libraries and frameworks that power ColdFusion. Update 25 includes major upgrades to components such as:

  • Apache Maven 3.9.16
  • Log4j 2.25.4
  • Jetty 9.4.58
  • jQuery 3.7.1
  • Apache Tika 2.9.4
  • Commons libraries
  • Netty components
  • CXF services framework

These upgrades help improve compatibility, stability, maintainability, and overall platform security.

Query-of-Queries Enhancements

Developers who rely on Query-of-Queries (QoQ) will benefit from several important improvements.

Consistent NULL Evaluation for Varchar Columns

Previously, QoQ operations could return inconsistent results when evaluating IS NULL and IS NOT NULL predicates against varchar columns. The behavior could differ between varchar and numeric data types even when both contained equivalent NULL values.

Update 25 now provides:

  • Consistent NULL handling across varchar and integer columns
  • Reliable IS NULL filtering
  • Reliable IS NOT NULL filtering
  • Consistent behavior regardless of ColdFusion null support settings

This results in more predictable query processing and reduces edge-case issues in data-driven applications.

Improved Query Sorting Metadata

A long-standing edge case could cause datatype metadata corruption when sorting Query-of-Queries using fully qualified column names and subsequently adding new columns through queryAddColumn().

Update 25 preserves column type metadata correctly after sorting operations, ensuring that newly added varchar columns remain varchar and preventing DataTypeMismatchException errors.

 

Better Query Metadata Preservation

querySlice() Now Retains Column Types

Developers using querySlice() may have noticed that sliced queries occasionally lost original column type metadata.

For example:

  • Integer columns could lose integer metadata
  • Varchar columns could lose varchar metadata

With Update 25, the returned query now preserves the original query's metadata, making serialization, type-sensitive processing, and framework integrations more reliable. Existing code requires no modifications to take advantage of the enhancement.

...and a lot more.. View the tech notes for more information.

We strongly recommend that all ColdFusion 2023 customers upgrade to Update 25 and review the latest security guidance and Lockdown recommendations as part of their update process.

Have questions about Update 25 or have feedback after upgrading? Join the discussion here on the Adobe ColdFusion Community Forum and let us know your experience.

    22 replies

    fantastic_creator8162
    Participant
    October 6, 2026

    After upgrading to 25 with a successful installation 0 error log most of my log viewing is broken.  Logs exist, are being written to but most of them throw:

     

    Complex object types cannot be converted to simple values.
    The expression has requested a variable or an intermediate expression result as a simple value. However, the result cannot be converted to a simple value. Simple values are strings, numbers, boolean values, and date/time values. Queries, arrays, and COM objects are examples of complex values.
    The most likely cause of the error is that you tried to use a complex value as a simple one. For example, you tried to use a query variable in a cfif tag.

     
    The error occurred in _searchloglogic_cfformat.cfm: line 68
    Called from _searchloglogic_cfformat.cfm: line 54
    Called from _searchloglogic_cfformat.cfm: line 44
    Called from _searchloglogic_cfformat.cfm: line 35
    Called from _searchloglogic_cfformat.cfm: line 1
    Called from _searchlog_cfformat.cfm: line 5
    Called from searchlog.cfm: line 127
    -1 : Unable to display error's location in a CFML template.

     

    I’ve worked through the jvm possible solutions and other solutions and nothing has worked.  I know this is specific to 25 because the install was completely operational 15 minutes prior to installing and after service restart and admin login the first area I navigated to was the logging module.   So, is Adobe working to resolve this or are they going to ignore this and everyone else who has run into the same issue.

    Translate
    Joseph388194533qbd
    Participating Frequently
    October 8, 2026

    We experienced this as well. Bug submitted in Adobe’s Bug tracker for this issue https://tracker.adobe.com/#/view/CF-4234708

    Translate
      jrathmann01
      Participating Frequently
      September 28, 2026

      After installing ColdFusion 2023 update 25, I cannot start the application service, it fails each time I try. I have tried to run the install through the administrator site as well as manually. Can anyone provide any assistance? On a side I do not have the Sandbox security enabled.

      I am not sure what else to try. Here is the error I am seeing in the coldfusion-error.log file:

      Sep 28, 2026 12:32:55 PM org.apache.catalina.core.StandardContext setPath
      WARNING: A context path must either be an empty string or start with a '/' and do not end with a '/'. The path [/] does not meet these criteria and has been changed to []
      Sep 28, 2026 12:32:55 PM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
      INFO: The Apache Tomcat Native library which allows using OpenSSL was not found on the java.library.path: [C:\ColdFusion2023\cfusion\lib;C:\ColdFusion2023\cfusion\jintegra\bin;C:\ColdFusion2023\cfusion\jintegra\bin\international;C:\\ColdFusion2023\\jre\bin]

       

      Not sure if I am missing something but this is the first time I have ever run into an issue with a CF update.

      Environment is: CF23 on Windows Server 2025, lockdown is configured.

      Translate
      Charlie Arehart
      Community Expert
      Charlie ArehartCommunity Expert
      Community Expert
      September 28, 2026

      ​@jrathmann01 As for cf not starting, those lines in that log are ones you should see when it DOES start. If you look at previous startups, do you see them there? More important, if you look at the coldfusion-out.log, do you see it ending only with log entries of CF stopping?

      Assuming that's so, your challenge is to find why it's not starting. And there are situations (including one new for this update) where cf won't start, and there will be no log lines (not even in Windows Event Logs, despite what the service start failure will report).

      Instead, open a command prompt (as admin) and run cfstart as found in the cfusion/bin folder. What do you see? Let us know. 

      If it's about being unable to find the instrument library, that's a new issue specific to this update (though it had happened previously under other conditions). It happens when cf is configured to use fusionreactor or another tool with a java agent which loads this diagnostic "instrument" Java library. A quick fix is to remove the Java agent jvm arg, though that removes fr or the tool in question.

      There's another work around some are sharing. I'm working on finding a better one, and which may also better help Adobe to know what changed that folks are running into, whether to fix it or document it. Let us know what you find, either way.

      I'd add what I learn here and in my blog post on u25 from last week, which I've updated already about a couple other issues. . 

      Finally, if there's urgency for you and you don't want to await back and forth here, I can help in a brief shared desktop consulting session. For more on my rates, approach, satisfaction guarantee, online calendar, email, phone, and more, see the consulting page at carehart.org.

      Translate
      /Charlie (troubleshooter, carehart. org)
      jrathmann01
      Participating Frequently
      September 28, 2026

      Thanks for the prompt reply Charlie. From what I am seeing, when I run the cfstart I get “Error loading: C:\\ColdFusion2023\\jre\bin\server\jvm.dll”. 

      Also, in the coldfusion-out.log it does end with CF Stopping: Sep 28, 2026 14:59:31 PM Information [Thread-33] - ColdFusion stopped (restored an old copy and ran it again, which is why the date and time are recent.)

      Please let me know if you need me to provide anything else.

      Translate
      Charlie Arehart
      Community Expert
      Charlie ArehartCommunity Expert
      Community Expert
      September 24, 2026

      If it may help readers, I want to share here some thoughts/observations which I’d offered also this morning on the Adobe CF Portal post about the update (https://coldfusion.adobe.com/2026/09/adobe-coldfusion-2023-release-update-25-is-here/):

      • First, some will want to hear that no, there is no corresponding update released today for CF2025. In fact, much of what is in this update are things that were released on CF2025’s update 8. (Some will recall that when THAT update came out, there was also no corresponding update to CF2023.)
      • As a demonstration of that previous point, one can see that most of the “bugs fixed” listed in this update’s technote (linked to above) are in fact the same bugs listed as “bug fixes” in the CF2025 update 8 release notes. (There’s not a perfect match, but a very high correlation.)
      • That said, while update 8 of CF2025 had added MANY new features (AI and much more), you can see from the post above that this update has only a few feature changes (beyond the many library updates and bug fixes). So it’s NOT accurate to conclude that “this update brings CF2023 in line with CF2025 functionality”, but it does bring it “a bit more in line”.
      • It’s curious to see that while this post has a bit more info on these few qofq changes (null handling, sorting, queryslice/metadata), that same info is NOT offered in the cf2023 update 25 update technote. It merely mentions those words, not the additional detail offered here. It’s unfortunate that people seeing only the update technote won’t really be able to discern the changes unless they find this post.
      • Then again, this post currently ends that list of changes saying “…and a lot more” and pointing us to the update technote. But it only has “more” about bugs fixed, as far as I can tell. Again it has LESS detail about feature changes than this post.
      • FWIW, the update technote does indicate that 33 of the CF packages/modules are upgraded in this update. 
      • Finally, if anyone may conclude that it seems this update “has no security fixes for CF” (based on the indicated changes), that’s not quite accurate. Note how the post above says (after the list of upgrades to the various Java libraries that CF embeds): “These upgrades help improve compatibility, stability, maintainability, and overall platform security.” So this is indeed a “security update”, by that assocation.

      It will be interesting to hear what other ramifications may come from folks applying the update. I don’t recall hearing much about the listed things when CF2025 update 8 was released, so hopefully this one goes smoothly for most folks.

      Of course, if you may be skipping to update 25 from an update earlier than 24, then you do need to be aware of the changes brought by update 24 and any others you may have skipped. Those updates DID introduce sometimes-breaking changes, for the sake of security–and generally they offered an optional JVM arg that could be used to revert such changed behavior, to aid in migration (though such jvm args should not be relied on permanently, as they do revert improvements intended to increase security.)

      Translate
      /Charlie (troubleshooter, carehart. org)
      Charlie Arehart
      Community Expert
      Charlie ArehartCommunity Expert
      Community Expert
      September 28, 2026

      I'd also created a post about the update on my blog last week, the night the update came out. I share some additional info, and indeed a couple of updates since then. 

      Translate
      /Charlie (troubleshooter, carehart. org)
      Simranjit Singh
      Participating Frequently
      September 23, 2026

      I installed this update on our CF2023 developer and some of the packages including cfadmin were uninstalled. I was able to use cfpm.bat to re-install and get it all working again. This has never happened before and I used our standard workflow to install the update.
      I’ve also created a post 

       

      Translate
      Charlie Arehart
      Community Expert
      Charlie ArehartCommunity Expert
      Community Expert
      September 24, 2026

      Simranjit, this actually does happen to people (in about every update), for various different reasons. It’s as often not a bug in the update but some unexpected error in the process of applying it. I realize that’s of little consolation for you, but I say this to convey to other readers that they should not necessarily expect to experience what you did.

      FWIW, I have applied today’s update on many machines, different operating systems, and both using the admin as well as using the manual offline command-line install approach (on a disconnected server). I did not experience the error you did. I hope to have time to look into your other thread, perhaps tomorrow. It’s been a very long day, so I need to call it a night.

      Translate
      /Charlie (troubleshooter, carehart. org)
      Simranjit Singh
      Participating Frequently
      September 24, 2026

      Thanks Charlie for reaching out. This is the first time it has happened in last 8 years or me working with CF. I too was doing the offline command line install too which is why this seemed odd to me and thought that best would be to reach out to see if anyone else had this issue.

      Translate
      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices