Exit
  • Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
  • 한국 커뮤니티
1

NOW LIVE! ColdFusion 2025, 2023, and 2021 May security updates

Adobe Employee ,
May 13, 2025 May 13, 2025

We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes:

 

These updates resolve several critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution, and security feature bypass. View the security bulletin, APSB25-52, for more information.

 

Download the updates

 

What's new in the updates

  • New JVM flags
  • Changes to remote method
  • Refreshed add-on installers
  • Pathfilter changes

 

Others

  • Bug fixes
  • Known issues

 

Docker and cffiddle

 

Please download and apply the updates and provide your feedback.

2.6K
Translate
Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
Jun 12, 2025 Jun 12, 2025

On a 2023 box i'm running into the problem that my scheduled tasks are missing.
According to the patch notes this is expected, but the neo-cron.bak file that I should be able to restore is also empty.

Translate
Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Expert ,
Jun 13, 2025 Jun 13, 2025

Sadly, yes. This is a long-time problem of the scheduled task mechanism, that it keeps only one generation of backup--and various things cause CF to rotate that, so that a problem can quickly make it that no good backup remains, unless you take one yourself (and few bother). I will note that the technote was modified some days after it came out to warn that "Before applying the update, take a backup of the neo-cron.xml file located in the <cf_root>/cfusion/lib directory." That's of course too late for you.

 

If you have no server backup to revert to, then you may be out of luck with no choice but to recreate the tasks. As for what their name and URL was, you can find that info in the scheduler.log (if you told CF to log tasks, which tracks the name and time) and in the http.log (which tracks ALL calls out of CF to any url, whether via cfhttp or via a scheduled task, and which tracks the url and the time).

 

(And if anyone may wonder if the backup folder for the update, within hf-updates, might track the neo-cron.xml file, sadly it does not. I have not ever found any of the neo*.xml files in there.)

 

While we're on this topic, a thought would be that some people may come to realize that it could be valuable to put the neo-cron.xml files under some sort of version control--automatically detecting and saving when the file changes. But I'll add also that the CF2023 feature called CCS (or central confuguration service) would itself track backups of changes made. Again, all too late for those bit by this updaet issue already. I don't work for Adobe and had no hand in the matter, other than trying to help people once it's happened.


/Charlie (troubleshooter, carehart. org)
Translate
Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources