NOW LIVE! ColdFusion 2025 and 2023 — April 2026 Security Updates

Forum|Forum|1 month ago
April 14, 2026
4 replies
381 views

NOW LIVE — the April 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update addresses multiple security issues and includes important mitigations we recommend you apply as soon as possible.

What’s included

The April 2026 release contains:

Tomcat upgrades. See the respective tech notes for more details.
Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors).
Patches to harden request handling, deserialization paths, and template parsing logic.
Updates to packages.

Why you should install this update

These fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.

Download the updates

See the tech notes

Docker and CFFiddle

CFFiddle is now updated with the changes
The Docker images are also updated:
- Docker Hub - ColdFusion Images
- Amazon ECR - ColdFusion Images

Feedback and support

As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.

Thanks,

Team ColdFusion

DevScreen

Inspiring

I am not sure if it was this one update or a recent one, but it has broke our scheduled tasks in CFAdmin. Pause, Resume and Play icons work but we are not able to create a new Scheduled Task or Edit an existing one. We have CF 2023.0.19.330899 on both local and live servers and does this on both. It also does this on CF 11,0,19,314546. Whenever a new task schedule is attempted, or edit an existing one, after hitting the “Submit” button on the form, the browser says “Server sent back an empty page”. I have tried in different browsers and it gives same results. Can you help?