Copy link to clipboard
Copied
We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes:
These updates resolve several critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution, and security feature bypass. View the security bulletin, APSB25-52, for more information.
Download the updates
What's new in the updates
Others
Docker and cffiddle
Please download and apply the updates and provide your feedback.
Copy link to clipboard
Copied
On a 2023 box i'm running into the problem that my scheduled tasks are missing.
According to the patch notes this is expected, but the neo-cron.bak file that I should be able to restore is also empty.
Copy link to clipboard
Copied
Sadly, yes. This is a long-time problem of the scheduled task mechanism, that it keeps only one generation of backup--and various things cause CF to rotate that, so that a problem can quickly make it that no good backup remains, unless you take one yourself (and few bother). I will note that the technote was modified some days after it came out to warn that "Before applying the update, take a backup of the neo-cron.xml file located in the <cf_root>/cfusion/lib directory." That's of course too late for you.
If you have no server backup to revert to, then you may be out of luck with no choice but to recreate the tasks. As for what their name and URL was, you can find that info in the scheduler.log (if you told CF to log tasks, which tracks the name and time) and in the http.log (which tracks ALL calls out of CF to any url, whether via cfhttp or via a scheduled task, and which tracks the url and the time).
(And if anyone may wonder if the backup folder for the update, within hf-updates, might track the neo-cron.xml file, sadly it does not. I have not ever found any of the neo*.xml files in there.)
While we're on this topic, a thought would be that some people may come to realize that it could be valuable to put the neo-cron.xml files under some sort of version control--automatically detecting and saving when the file changes. But I'll add also that the CF2023 feature called CCS (or central confuguration service) would itself track backups of changes made. Again, all too late for those bit by this updaet issue already. I don't work for Adobe and had no hand in the matter, other than trying to help people once it's happened.
Find more inspiration, events, and resources on the new Adobe Community
Explore Now