Questions

our security team wants us to implement Multi Factor Authentication using a token based system.  I located https://github.com/marcins/cf-google-authenticator which references CF10 and i was pleased becasue we still haven't been approved to move our app from CF 11 to a supported version but beyond serving as a sample has anybody got any idea how long it might take to implement either google authenticator OR another token based system. I'm being told that other 2FA methods are not approved (SMS, Email, etc) because they are not secure so they aren't options at this time. Any Advice, Recommendations, or realtime experience (it took us x long) would be appreciated.  I hope this wasn't too vague, i just don't want to put too much in the post.

Hi,I administrate a few ColdFusion 2023 servers on windows. I perform an off-line update whenever a new update comes out. I carry out these following steps:1) Download new hotfix and packages from Adobe Website2) copy these files into the Bundles directory of ColdFusion3) run the java -java hotfix_xxxx.jar4) the installation states it was "successful" but everytime there are packages that were removed and not reinstalled. These new packages files were definitely included in the bundles directory, but they were deleted during the update process5) My fix everytime is to re-copy these files back into the Bundles and install the packages manaually.Do anyone know how i can perform the update, without needing to re-copy certain package files back into the Bundles to complete the process?Thanks for any help you maybe able to provide! 🙂

Coldfusion cfgrid type= boolean checkbox column is not getting checked in a single click, requires user to click twice. Causing a bad user experience   Update: here is a running example of the issue, as offered by Charlie in the discussion below: https://www.carehart.org/test/test-cfgrid-10755642.cfm

I could not find discussion on this topic and I think it could be serious for some environments.On IIS cfm handler why there is no use of buffer ? the handlers are configured with responseBufferLimit="0". Is there any reason. It seems it could be a serious issue.

Good morning, all. I have code that has been in place for at least 6 or 7 years that generates Excel files.  Depending upon the app, the Excel file is either A) made available to the user via download, or B) emailed to a pre-determined email address, possibly CC'ing others, as well.  It has had no issues for all this time, and no changes to the code have been made. Recently, while creating a new section of a public-facing website, I copied and modified Excel generating code from one of these older sections, expecting it to work.  I've been having all kinds of issues, from files not being saved to the server, to simple strings added to a cell coming up as garbage.  Exceptions are being thrown.  So, I decided to check one of the earlier pages on the public site that creates Excel files, and lo and behold it's throwing an exception when it comes to creating the Excel file.  I have no idea how long this has been breaking, no one ever reported anythin

In ColdFusion 2021 update 20 (as well as cf2023 update 14 and cf2025 update 2), there was a change in access to remote CFC methods, requiring explicit cfarguments tags or defining them directly in the function signature.   The -Dcoldfusion.runtime.remotemethod.matchArguments flag set to false allows methods with remote access to continue working without restriction on argument matching.   Making all methods compatible with remote access in our programs will be quite complex and will require a long development and testing time on the systems. Since we seek the integrity of our methods by other means, set the flag to false solves our problem.   So I would like to know if this JVM flag will be deprecated in the future? If it is something permanent, we will set it to false and dispense with any rework with the compatibility of remote CFC methods.

Since updating to update 21 from update 20, opening Scheudle Tasks in cfadmin is erroing on some scheduled tasks that were created before update 21.  The impacted tasks can be edited and resaved which will clear the error.New scheduled tasks can be created and appear to be working as normal.  The error we're seeing for impacted tasks: Element ISVALIDPUBLISHPATH is undefined in TASK.The error occurred in scheduletasks.cfm: line 700Called from scheduletasks.cfm: line 568Called from scheduletasks.cfm: line 567Called from scheduletasks.cfm: line 564Called from scheduletasks.cfm: line 524Called from scheduletasks.cfm: line 482Called from scheduletasks.cfm: line 1

I got the infamous architecture mismatch trying to set up an ODBC Data Source from Cold Fusion(2011) to an AS400 data source(1st screentshot).Since it took me two days to track this one down I thought I'd pay it forward by showing you how I fixed it in the hopes of saving someone some time in the future.I tried many different fixes to match architectures thinking I had the 32 bit version of the ODBC driver vs the 64 bit version and vice versa. I have both, it didn't matter.The problem was in the Windows Registry, specifically the data source HAS TO HAVE the same name across 32 and 64 bit ODBC entries for it(2nd and 3rd screenshots). Stack Trace:Connection verification failed for data source: AS400java.sql.SQLException: [Macromedia][SequeLink JDBC Driver][ODBC Socket]internal error: The specified DSN contains an architecture mismatch between the Driver and ApplicationThe root cause was that: java.sql.SQLException: [Macromedia][SequeLink JDBC Driver][ODBC Socket]internal error: The

Hi Just wondering if anyone has any experience with implementing connection retry logic with Coldfusion and Azure sql, to handle transient connection failures. I have an application that is hosted on Azure with Azure SQL and there have been a few instances where the DB has failovered intermittently while a user was requesting a page, thus resulting in an error. Looking to see how I can minimize this impact and make it a seamless experience on the user's end when this occurs. I've looked at https://docs.microsoft.com/en-us/ef/ef6/fundamentals/connection-resiliency/retry-logic which is based on an EF6 library. Thanks!

I just updated CF 2023 from 6 to 15, and applicaton is not working with below error:any idea what's missing? Thanks.Variable HTTP_REFERER is undefinedcoldfusion.runtime.UndefinedVariableException: Variable HTTP_REFERER is undefined. at coldfusion.runtime.CfJspPage._get(CfJspPage.java:456) at coldfusion.runtime.CfJspPage._get(CfJspPage.java:411) at coldfusion.runtime.CfJspPage._get(CfJspPage.java:390) at coldfusion.runtime.CfJspPage._autoscalarize(CfJspPage.java:2364) <CFIF (ReFindNoCase("login/login.cfm",HTTP_REFERER) EQ 0 AND ReFindNoCase("login/login.cfm",SCRIPT_NAME) EQ 0 AND ReFindNoCase("login/action_login.cfm",SCRIPT_NAME) EQ 0)> <CFIF IsDefined("SESSION.LOGGEDIN") and SESSION.LOGGEDIN EQ "TRUE"> <CFELSE> 

We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 2 ColdFusion (2023 release) Update 14 ColdFusion (2021 release) Update 20   These updates resolve several critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution, and security feature bypass. View the security bulletin, APSB25-52, for more information.   Download the updates ColdFusion 2025 updates ColdFusion 2023 updates ColdFusion 2021 updates   What's new in the updates New JVM flags Changes to remote method Refreshed add-on installers Pathfilter changes   Others Bug fixes Known issues   Docker and cffiddle CFFiddle is updated. Docker images of the update are avaiable on Docker hub and Amazon ECR.   Please download and apply the updates and provide your feedback.

hi,  my CF 2023 enterprise license will expire on Nov. 1 2025, I am thinking not to renew because the application is schedule to move to other platform around Dec. 30 2025. Now the question is can my CF server keep up and running until Dec. 30 2025 with expired license? Thanks.David

Hi All,Hoping someone can provide some pointers to solve this.I was successfully running on CF2023 update 11 but when I went to update 14 Apache Tomcat mod_jk connector stopped working - i've reverted back to update 11 and it still doesn't work - the browser returns 403 ForbiddenI've checked my server.xml, worker.properties, mod_jk_vhost.conf a million times and they seem to be correct.  I changed the Port being used by the connector in case that was a problem. I'm seeing in mod_jk.log:[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0130 63 68 65 2F 32 2E 34 2E 36 32 20 28 55 6E 69 78 - che/2.4.62.(Unix[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0140 29 20 4F 70 65 6E 53 53 4C 2F 33 2E 33 2E 32 20 - ).OpenSSL/3.3.2.[Wed Jun 18 08:31:41 2025] [301783:140594684778048] [debug] ajp_connection_tcp_send_message::jk_ajp_common.c (1368): 0150 6

Hello - Developer edition of CF 2025 running locally on a Mac (OS = Sequoia 15.5). DMG installer. A CFQuery to an MS SQL Server datasource produces this error message: 'Error Executing Database Query. The sqlserver package is not installed. You can install the package through the CLI package manager (/Applications/ColdFusion2025/cfusion/bin/cfpm.sh) by running the command : install sqlserver.'The Packages section of the CF Administrator shows that the sqlserver package already is installed. Same if I attempt an install via the CLI package manager. I've also uninstalled and re-installed the package. Any thoughts?(The query runs without error on CF 2016 or 2018. The datasource verifies in the Administrator (i.e., the 'OK' message.)

We're in the process of migrating from CF2021 to CF2023, and so far everything has been going well except for getting a REST service registered. Using the same path and service mapping as we did in CF2021 we are getting the following error:Error registering REST service. Please ensure that you have entered a proper mapping and path. Application Calendar could not be initialized. Reason: Cannot invoke "java.lang.Boolean.booleanValue()" because "skip" is null Cannot invoke "java.lang.Boolean.booleanValue()" because "skip" is null In trying to research this, I came across what appeared to be an identical case on the bug tracker (CF-4220013 | Tracker (adobe.com)), which was withdrawn as a duplicate of another issue. However, that other issue (CF-4219459 | Tracker (adobe.com)) loads with a page that says "No issue found." I can't seem to find anything else that helps. Is this an actual bug? Has anyone else run into this? Has anyone else solved it?

Hi everyone,I've been working with the Adobe ColdFusion 2021 AMI on AWS (Windows) and noticed that Docker is installed by default. However, the ColdFusion documentation and AWS Marketplace listing don’t mention Docker as a requirement or dependency.While scanning the instance for security vulnerabilities, we identified two Docker-related CVEs:CVE-2021-21184CVE-2021-21185These are medium to high severity issues affecting Docker Desktop.Questions:Is Docker required for ColdFusion to run properly on this AMI?Can I safely uninstall Docker without impacting ColdFusion functionality?If Docker is required, can I safely upgrade it to the latest patched version?I’d appreciate any clarification or official guidance. I want to ensure we maintain a secure and minimal environment without removing something critical to the ColdFusion runtime.Thanks in advance for your help!Best,

Hello, I would like to know if I have coldfusion 2021 can i upgrade to 2023 without additional cost or a new license is required?

I'm updating a ColdFusion 2021 installation from V.13 to V.14 when V.14 installed the administrator came up except for the pakage manager page, it throws an error, when I look at the exception log I see the following: "Error","http-nio-8544-exec-7","07/08/25","16:33:29","cfadmin","coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object; The specific sequence of files included or processed is: F:\ColdFusion2021\cfusion\wwwroot\CFIDE\administrator\updates\index.cfm, line: 733"java.lang.NoSuchMethodError: coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object;at cf_core2ecfm1148457877$funcGETINSTALLEDUPDATES.runFunction(/CFIDE/administrator/updates/_core.cfm:733).I've restarted the service, flused the felix-cache, even checked the validity of neo-updates.xml and bundlesdependency.json. I'm at a loss.Fortunately this is a testbed instance so I can throw the server away and have my VMWare team cl

My web server is using CF2021 update18 (Log4j version 2.20.0: jmx enabled default: -Dlog4j2.disable.jmx=false).-When I set metaspace = 256, the memory has nearly 2 million elements of org.apache.logging.log4j.core.jmx.LoggerContextAdmin (watched by jmap -dump).-When metaspace = 512, the memory drops to about more than 500 thousand elements.-When disabling jmx (-Dlog4j2.disable.jmx=true, Log4j Starting in version 2.24.0 JMX support is disabled by default), the memory no longer has .jmx.LoggerContextAdmin (as expected to reduce memory). So my question is: When disabling jmx, will it affect coldfusion? (my web server)※I hope it doesn't affect anything my web serverBest regards.

I'm trying to submit a bug report for ColdFusion using the Adobe Bug Tracker ( https://tracker.adobe.com/#/add_bug ) and when I select ColdFusion from the dropdown, the progress indicator just spins and spins.  There are a lot of 400 errors in the console too, so it appears the Bug Tracker has a bug of it's own.   Is this the correct location to report a bug?  Or has it been replaced and is no longer in service? Thank you!

Problem Description: DateFormat is returning a 9 character date instead of an 8 character one.Steps to Reproduce:1. Add the following to any Cold Fusion page:<cfset testDate = DateFormat(Now(),"YYYYMMDD")><cfoutput>Current Now(): #Now()#<br>Test DateFormat: [#testDate#] (Length: #Len(testDate)#)<br></cfoutput>Actual Result:Current Now(): {ts '2025-07-08 13:57:51'}Test DateFormat: [202507189] (Length: 9)Expected Result:Current Now(): {ts '2025-07-08 13:57:51'}Test DateFormat: [20250708] (Length: 😎Any Workarounds: I checked my system clock and it is indeed set to 7/8/2025 (today) so I know it's not the system clock. I also updated Cold Fusion 2023 to the latest update(15) and restarted the server but it didn't help, I still get the same error.Browser Info: Chrome-----------------System Information------------------Time of this report: 7/8/2025, 14:04:50Machine name: ITJN-JHTSY84Machine Id: {921ECBB9-6C70-4E25-A872-0A8995BFE289}Operating System: Windo

On my server, I've got a few scheduled tasks set up. Yesterday, after a while, I wanted one of the tasks to run at a different time. After doing the edits and clicking the "Submit Changes" button, I got this error:Invalid extension of the file name. Valid extensions are :log,txt Didn't have this issue before, so I am not sure what's causing it. Here are the server details:  

Recently a vendor we work with updated their server to support TLS 1.3 in addition to TLS 1.2 and our CFHTTP calls to their API are now failing with an Errordetail "I/O Exception: www.thevendor.net:443 failed to respond" - Testing from our server to theirs using java (11.0.10) SSLPoke succeeds.- Scanning their API endpoint with the SSLLabs testing tool shows no issues.- Accessing their API endpoint with Chrome browser has no issues.- If I modify our code to use the CFX_HTTP5 custom tag, the connection succeeds.- If I add jvm.config flags to force TLS 1.2, the connection succeeds, specifically:-Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 If I enable SSL handshake debugging with the jvm flag-Djavax.net.debug=ssl,handshake,verbosecoldfusion-error.log doesn't show an exception but the last few lines show these lines that I don't see in a successful TLS 1.2 connection:javax.net.ssl|DEBUG|E1|ajp-nio-127.0.0.1-8020-exec-4|2021-03-30 19:44:22.918 CDT|SSLCipher.java:19

Hello,I had Encountered couple of issues after update ColdFusion 2023 Update 5 to Update 10. 1. ColdFusion could not delete the file C:\Request Form1.pdf. . The cause of this exception was: java.nio.file.FileSystemException: Request Form1.pdf: The process cannot access the file because it is being used by another process. <br>The error occurred on line 8.below is the code. When I add the <cfset sleep(500) /> before a file deletion then it works fine.<cffile action="readbinary" file="#filelocation#" variable="clobVar" /><cffile action="delete" file="#filelocation#">2. It seems some of the configuration missed related to custom Java class for below code I am getting an error as "Object Instantiation Exception. Class not found: org.util.pdf.AppendLetterPDFs <br>The error occurred on line 32." for below code. But I am not sure where the Jar or packages mapped or configured.<CFOBJECT ACTION="CREATE" TYPE="JAVA" NAME="appender" CLASS="org.util.