Community Manager

Blog

NOW LIVE: ColdFusion 2025 and 2023 October 2026 Security Updates

36 replies
877 views
Translate

NOW LIVE — the October 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass.

What’s included

The October 2026 release contains:

Tomcat upgrades. See the respective tech notes for more details.
Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors).
Updates to packages.

Why you should install this update

These fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.

Download the updates

See the tech notes

Feedback and support

As always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and clarifications.

Thanks,

Team ColdFusion

E

EvanSinceCF31

Participating Frequently

Any news on an update to bring the Tomcat embedded in CF2023 to 9.0.123?

Our cybersecurity team is telling me they will uninstall the 9.0.122 version of Tomcat shipping with update 26 because “Apache Tomcat versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122 are affected by a vulnerability in HTTP/2 processing of asynchronous servlets”

I don’t know if CF2023 would actually be vulnerable but some guidance from Adobe would be helpful!

Translate

B

bell_the_cat

Inspiring

I’m currently running ColdFusion 2023 update 24 on Linux. I’m trying to go directly to update 26 since 25 is supposed to be included. I update manually using an established process. The installation did not show any errors, nor did the log files after restart, but when I run <root>/cfusion/bin/cfpm.sh I get the following error:

Failed to load native library:jansi-2.4.2-f4025a5c2e165375-libjansi.so. The native library file at /tmp/jansi-2.4.2-f4025a5c2e165375-libjansi.so is not executable, make sure that the directory is mounted on a partition without the noexec flag, or set the jansi.tmpdir system property to point to a proper location. osinfo: Linux/x86_64 java.lang.UnsatisfiedLinkError: /tmp/jansi-2.4.2-f4025a5c2e165375-libjansi.so: /tmp/jansi-2.4.2-f4025a5c2e165375-libjansi.so: failed to map segment from shared object

There is no jansi-2.4.2-f4025a5c2e165375-libjansi.so file in /tmp. Am I missing something here?

Translate

B

bell_the_cat

Inspiring

OK, so I should have done more research before I posted. I was able to resolve. Turns out /tmp _did_ have noexec flag because of security. Not sure why this suddenly became a problem with jansi library, but there it is. I added the following flags to jvm.config and also when running the hotfix from comand line, where <cf-root> is the installation dir:

-Djava.io.tmpdir=/<cf-root>/tmp
-Djansi.tmpdir=/<cf-root>/tmp

I also had to add above flags to /<cf-root>/bin/cfpm.sh in the java call since that’s where error originated.

Hope someone else finds this helpful.

Translate

J

Josh O.

Participant

any mention of failed error handling since this update was installed?

Translate

M

michaelg11604920

Participating Frequently

https://github.com/wheels-dev/wheels/discussions/4627

this update broke the wheels framework. Wondering if Adobe is going to officially reply about the regex issues with a proper fix.

Translate

W

w49369461

Participating Frequently

I installed 2023 HF 26 on half my servers yesterday morning no problem. Today when updating the rest the CF service does not restart. When manually starting it I get this on all of them:

Error loading: C:/ColdFusion2023/jdk-17.0.20\bin\server\jvm.dll

If I uninstall HF 26, it works fine again.

File exists and works fine when HF 26 is not installed.

Has the hotfix been updated since yesterday? - I know there are some issues with it as I have also had to patch the RegEx problem on those servers I did yesterday.

Translate

T

Tim2842955474bi

Participating Frequently

I haven’t installed it yet, but did it clobber your C:\ColdFusion2023\cfusion\bin\jvm.config file? Previous updates sometimes did that for me.

Translate

W

w49369461

Participating Frequently

Managed to sort it, it seems Microsoft Visual C++ v14 Redistributable is a hard requirement now. We did not have this installed. Never been an issue before!

Translate

jeffh65754959

Inspiring

There are two jar files (2025 and 2023) attached to CF-4234761 and CF-4234762 this morning but no comment on the bugs regarding them, yet.

Translate

B

Beauteous_Wonderland548a

Participant

ColdFusion 2023 Updates 25 and 26 Contain Several Serious Bugs

I am genuinely surprised that these updates appear to have been released without sufficient testing. In my experience, software updates should undergo thorough quality assurance before being made available to customers.

Unfortunately, Updates 25 and 26 introduced a number of issues that affect existing installations and workflows.

1. Bug introduced in Update 25

When executing files using cfexecute, the full file path must now be specified. This behavior either changed unexpectedly or was not properly documented, causing compatibility issues with existing applications.

2. Bugs introduced in Update 26
2.1 Scheduled Tasks and security-settings.json

Scheduled task exceptions now have to be defined in the security-settings.json file.

This is inconvenient because after every ColdFusion update, administrators may need to reapply these settings. This creates unnecessary maintenance work and increases the risk of production issues if the configuration is overlooked.

2.2 Log File Access

As mentioned in this discussion, log files can no longer be opened directly from the ColdFusion Administrator and can only be downloaded.

This is a step backward in usability and makes troubleshooting less efficient.

Conclusion

These are only the issues I have encountered so far at first glance. I do not know what other surprises may appear in future updates.

I strongly encourage Adobe to check what is during all those Indian programmers and improve its testing and quality assurance processes before releasing updates. ColdFusion is widely used in production environments, and customers expect updates to be thoroughly tested and reliable.

Translate

B

Beauteous_Wonderland548a

Participant

Also I forgot bug number 3: Update 26 duplicated jar file which supporting

spreadsheet plugin so this jar file should be renamed otherwise the spreadsheet will not work: Rename-Item `
"C:\ColdFusion2023\cfusion\lib\commons-io-2.11.0.jar" `
"commons-io-2.11.0.jar.disabled"

Good Luck Indians ;-)

Translate

A

Adam Beers

Participant

We have updated a number of servers from CF2023 update 24 to update 26 and on all of them we have came across an error when trying to read log files in CFAdmin.

The main detail is:

Complex object types cannot be converted to simple values.

The stack trace is:

The error occurred in _searchloglogic_cfformat.cfm: line 68
Called from _searchloglogic_cfformat.cfm: line 54
Called from _searchloglogic_cfformat.cfm: line 44
Called from _searchloglogic_cfformat.cfm: line 35
Called from _searchloglogic_cfformat.cfm: line 1
Called from _searchlog_cfformat.cfm: line 5
Called from searchlog.cfm: line 127

After some testing we narrowed it down to any log file that has the header row:

"Severity","ThreadID","Date","Time","Application","Message"

If we archive or delete a log file then it is regenerated with the header and fails. If we stop the CF service, take out the header row in the log file and then restart CF it will then load in the log viewer.

Has anyone else came across this, or can they reproduce it?

Translate

Charlie Arehart

Community Expert

Adam, that is not new with this update. It happened starting with u25 (the one you skipped). It’s been reported on tracker...but tracker’s down so I can’t get the ticket to offer. But know that Adobe is (should be) aware of it...but no, it was not fixed by update 26.

Besides that trick of removing the header, you could also just add a space (anywhere on that header line), and it will now load the file. I had reported that in the ticket as a comment.

Finally, note that you can also still DOWNLOAD the log via that UI, so that’s another workaround until they fix it.

Translate

/Charlie (troubleshooter, carehart. org)

A

Adam Beers

Participant

Thanks Charlie,

We shall wait patiently for Adobe to fix it, and like you say, we can always download the file and review the logs that way.

Translate

DevScreen

Inspiring

This update broke ReReplace function, and has created a bit of a mess. I have posted more about it here:

We also noticed that session is not holding up for very long. We have specified session timeout at 2 hours in application.cfm file but users are getting kicked out in roughly 15 minutes. Haven’t had a chance to research this much yet, but we feel like this started happening around Update 25.

Translate

Charlie Arehart

Community Expert

@DevScreen Are you saying you’ve seen the various discussions of regex changes in yesterdays update technote(s), including the jvm args for reverting the changes?

As for session timeouts, I’ve seen nothing in the current or previous update technotes that relates to that, nor have I seen anyone else complain of that (nor have I yet experienced/tested it).

Not negating/denying the things you’re seeing, just adding another perspective if it may help.

Translate

/Charlie (troubleshooter, carehart. org)

DevScreen

Inspiring

I did, and I don’t really see something that should affect the functionality of our RegEx. There are 2 flags that deal with maximum lengths, another one is about timeout, and last one is about cache size. I don’t see how those would really affect my particular RegEx?

Translate

J

JC_BHS

Participating Frequently

For the sake of security, the fix is to block all URLs that are being accessed by default. Some of us have several APIs and other imports from external URLs that make it very time consuming to add all of the URLs being used to the “AllowList”. Not to mention, remembering to add future URLs to the list as well. If you miss one URL in a scheduled task, it fails. All of the RDS connections fail by default because they cannot access the directories that contain code. Adobe can claim that they’ve secured everything and now can blame you if you add the JVM arguments -Dcoldfusion.security.ssrf.disableProtection=true and -Dcoldfusion.rds.security.disableFileProtection=true to enable everything as before. I get it, but this feels more like curing a symptom, rather than curing the disease. Hopefully Adobe is looking into this further and is working on a way to secure ColdFusion properly and the manual process of adding URLs to allow access won’t be needed in the future.

Translate

Charlie Arehart

Community Expert

@JC_BHS When you say “the fix”, what are you referring to?

First, you're saying you have to add a lot of things to the new allowlist...but the default is "defaultAction": "allow", so that should not be necessary.

But then you start saying “the fix is to block all by default”. You can do that by changing the defaultAction to deny (and then you WOULD have to add things to the allowlist).

Note also that you can control these things at the server or app level. For those wondering what this is referring to, see the “Outbound network security policy” section of yesterday’s update technotes for either CF2025 or 2023.

As for the RDS matter, I agree that the jvm arg to revert things would be ham-fisted alone. Most of the other things that “protect” folders have also added an allowlist (though perhaps as a new feature of pathfilter.json, or a new file in the cfusion/lib folder). The technotes currently make no mention of that, and I have asked about that. At least then it would be in line with how many other things are being “made more secure”.

Translate

/Charlie (troubleshooter, carehart. org)

L

Legorol

Known Participant

@Charlie Arehart: the new Outbound network security policy does in fact block a number of destinations by default with the default “defaultAction”: “allow” setting. The technote states “including private networks, link-local addresses, and cloud metadata services”. I believe this is what JC_BHS is running into.

In other words, with the new update and with no user action and everything at default, many users will now find that HTTP/HTTPS requests (including from scheduled tasks!) are now blocked by default if the destination is, for example, an internal API on a private network.

For example, in our case we typically have many scheduled tasks that call cfm pages on the server itself, for example with http://localhost/some/scheduled/task.cfm. These scheduled tasks are now all failing by default.

I think this is quite an impactful change in this update, and this impact should be more widely publicised.

Translate

Show more replies

What’s included

Why you should install this update

Download the updates

See the tech notes

Feedback and support

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.