NOW LIVE! ColdFusion 2025 and 2023 August 2026 security updates
Adobe has released ColdFusion 2025 Update 12 and ColdFusion 2023 Update 23. The releases resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.
View the security bulletin, APSB26-90, for more information.
Download the updates
What’s new
New JVM flag
- -Dcoldfusion.xml.saxon.allowCollection
- -Dcoldfusion.debugger.bindhost
- -Dcoldfusion.websocket.requireAuthForInvoke
For more details, view:
New Application.cfc flag
this.wsRequireAuthForInvoke
This flag controls whether a WebSocket client must be authenticated before it can invoke access="remote" CFC methods over the channel. By default, its value is True.
For more details, view Application variables in ColdFusion.
Tomcat upgrade
- Tomcat 10.1.57 in CF 2025.12
- Tomcat 9.0.120.0 in CF 2023.23
New config file property
ccssecretkeyfingerprint in cfusion/lib/ccs/ccs.properties
The CCS key is now generated per installation using SecureRandom and bound to an environment fingerprint. It is regenerated when a system is cloned or restored from an image, preserved across restarts on the same host, and generated independently by each cluster node.
VS Code plugin update
Update 7 of VS Code plugin is a part of this release.
Performance Monitoring Toolset update
Updates to Performance Monitoring Toolset for both CF 2025 and CF 2023.
Download the updates and validate them in your staging environment. If you encounter any regressions or unexpected behavior after upgrading, report them through the Adobe support channel or your standard issue-tracking process, including relevant logs and reproduction details.
AdChoices