NOW LIVE: ColdFusion 2025 and 2023 October 2026 Security Updates

2 replies
80 views
Translate

NOW LIVE — the October 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass.

What’s included

The October 2026 release contains:

Tomcat upgrades. See the respective tech notes for more details.
Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors).
Updates to packages.

Why you should install this update

These fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.

Download the updates

See the tech notes

Feedback and support

As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.

Thanks,

Team ColdFusion

Charlie Arehart

Community Expert

I’ll also share that after doing each update (for cf2025 and cf2023), I found in my coldfusion-out.log that the very first line reported on startup was this error:

Cannot invoke "coldfusion.util.PasswordUtils.getSeedValue()" because the return value of "coldfusion.util.PasswordUtils.getInstance()" is null

But good news is that after restarting CF (in each case), the error did not appear again (and that was whether I HAD or HAD NOT deleted the felix-cache or cfclasses folders after the update and before that restart).

So I’m not so much documenting this to “report a bug”, but just in the hopes that users searching for info on this might find it and the news that a mere CF restart may “make this problem go away”.

Translate

/Charlie (troubleshooter, carehart. org)

Charlie Arehart

Community Expert

The wording above doesn't do justtice to the significance of the updates, let alone the changes made (done for the sake of improved security, of course). The technotes show LOTS of things impacted.

People will want to read the technotes carefully to assess potential impact on their existing apps before applying the update.