The official community for ColdFusion.
Recently active
NOW LIVE — the June 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass. What’s includedThe June 2026 release contains:Tomcat upgrades. See the respective tech notes for more details. Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors). Patches to harden request handling, deserialization paths, and template parsing logic. Updates to packages.Why you should install this updateThese fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.Download the updatesColdFusion 2025 updates ColdFusion 2023 updatesSee the tech
NOW LIVE — the April 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update addresses multiple security issues and includes important mitigations we recommend you apply as soon as possible.What’s includedThe April 2026 release contains:Tomcat upgrades. See the respective tech notes for more details. Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors). Patches to harden request handling, deserialization paths, and template parsing logic. Updates to packages.Why you should install this updateThese fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.Download the updatesColdFusion 2025 updates ColdFusion 2023 updatesSee the tech notesColdFusion (2025 release) Update 7 ColdFusion (2023 release) Update 19 Docker and CF
We are pleased to announce the availability of ColdFusion Builder Extension for Visual Studio Code. Needless to say, we are as excited as you are to release this plugin. Now you'll be able to edit and validate code, manage files, projects, and servers, debug, and scan for security vulnerabilities, directly on Visual Studio Code. What's in it for me A lot, actually. The all-new Adobe ColdFusion Builder extension for VS Code helps developers to edit and validate code, manage files and projects, and debug and scan for security vulnerabilities. Why do I need this extension? Integrate the Adobe ColdFusion Builder Extension on your VS Code to: Automate repetitive tasks and navigate code for a smoother and faster process. Enjoy built-in support for IntelliSense code completion, better semantic code understanding, and code refactoring. Identify security vulnerabilities and maintain the integrity of your code. Manage your work with extensions, remote project support, inte
Using coldfusion version 2021 on production.The daily scheduler is in running status.Its showing next running time, but last run Column is empty for some schedulers Please advise.
Using coldfusion version 2021 on production.The daily scheduler is in running status.Its showing next running time, but last run Column is empty for some schedulers.No error seen inl og. Please advise.
Photoshop version:27.9.1Steps to reproduce:Open a PSD/document. Place an image and convert it to a Smart Object. Use Free Transform to scale the Smart Object down. Press Ctrl+T again. Choose Distort. Move the four corner handles to create a trapezoid/perspective shape. Press Enter to commit the transformation. The transformed object itself remains in the correct position. However, the Transform bounding box/handles immediately jump to the upper-left corner of the document, completely away from the object. Pressing Ctrl+T temporarily puts the bounding box back around the object, but after pressing Enter it jumps to the upper-left corner again.Expected result:The Transform bounding box should remain around the transformed Smart Object.Actual result:After committing a Distort transformation, the bounding box and transform handles jump to the upper-left corner of the document and no longer correspond to the transformed object's position or dimensions.Additional information:The problem does
If you have schedule tasks that use CRONtime it would be nice to see that reflected in the Settings Summary.
Updated ColdFusion 2023 from update 22 to update 23. After restarting every instance aside from the cfusion instance would crash upon restarting. In the coldfusion-errors.log, you have two entries: SEVERE: End event threw exceptionjava.lang.NoSuchMethodException: Cannot find method [setChannel] in object [StandardEngine[Catalina]] of class [class org.apache.catalina.core.StandardEngine] at org.apache.tomcat.util.IntrospectionUtils.callMethod1(IntrospectionUtils.java:541)WARNING: Catalina.start using D:\ColdFusion2023\D1/runtime/conf/server.xmlorg.xml.sax.SAXParseException; systemId: file://D/ColdFusion2023/D1/runtime/conf/server.xml; lineNumber: 117; columnNumber: 19; Error at line [117] column [19]: [Cannot find method [setChannel] in object [StandardEngine[Catalina]] of class [class org.apache.catalina.core.StandardEngine]]No other log files were generated. The cfusion instance operated normally and we were able to uninstall the update.
Adobe has released ColdFusion 2025 Update 12 and ColdFusion 2023 Update 23. The releases resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.View the security bulletin, APSB26-90, for more information.Download the updatesColdFusion 2025 updates ColdFusion 2023 updatesWhat’s newNew JVM flag-Dcoldfusion.xml.saxon.allowCollection -Dcoldfusion.debugger.bindhost -Dcoldfusion.websocket.requireAuthForInvokeFor more details, view:JVM arguments in CF 2025 JVM arguments in CF 2023New Application.cfc flagthis.wsRequireAuthForInvokeThis flag controls whether a WebSocket client must be authenticated before it can invoke access="remote" CFC methods over the channel. By default, its value is True.For more details, view Application variables in ColdFusion.Tomcat upgradeTomcat 10.1.57 in CF 2025.12 Tomcat 9.0.120.0 in CF 2023.23New config file propertyccssecr
We have a legacy app that extensively uses CFTABLE and CFCOL. Since these tags were removed from CF2025 I was wondering if it would be possible for Adobe to post the source code for these tags so that we can define them as customtags so that we don’t need to manually re-write every page in this application. It doesn’t seem like it would be that big of a deal for them to do this and it would save us a great deal of time and effort as all we would need to do is change <CFTABLE to <CF_CFTABLE and <CFCOL to <CF_CFCOL [or whatever the customtag is called] instead of changing all of the HTML on every single CFM file.thanks.
There are a few issues with this page that I wanted to report. The ColdFusion Updates download link is not a link, but is formatted as a link (Download and install updates for Adobe ColdFusion (2023 release). Adobe recommends always applying the latest ColdFusion (2023 release) update.) This should link to the ColdFusion 2023 Updates page, but does not. Java SE 17.0.19 has some high-severity issues and Java SE 17.0.20 was released on 7/21/2026 and still has not been posted to the site. Can you please post that? The bottom of the page shows a Document History section that is badly neglected - showing only document updates from 2023!
Will need to upgrade Windows server from 2016 to 2019 or 2022. Will Coldfusion 2021 release be compatible with Windows Server 2019 or 2022? thanks
Hi,I recently downloaded and installed the version ColdFusion 2025 trial edition using GUI installer.After the installation,I was able to access the ColdFusion Administrator page successfully.However,I do not see the start/stop option for the ColdFusion Application Service in the windows Services console. So, I am unable to restart the service.Could you please advise how to enable or access the ColdFusion service? Thank you
Today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion. I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. I have a secure server, so i cannot use the CF Administrator to install. I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip. However the hash published on that page for the hotfix and packages repository:“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash. Below are the results of my download, the file sizes of downloaded files and the hash results.comman
today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion. I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip. However the hash published on that page for the packages repository: (MD5:651E86B76AF4D405EAB2D177EC82EAE3)“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3)”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash. Below are the download command, results of my download, the file sizes of downloaded files and the hash results.command prompt visual with som
today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion. I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip. However the hash published on that page for the packages repository:“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash. Below are the results of my download, the file sizes of downloaded files and the hash results.command prompt visual with some information removed showing the curl call that downloaded
Hi Support team, I am working on a project in ColdFusion version 2023. Looking to setup the project in dev environment, but it seems the developer/trial version for 2023 link is not activeon the website url below. Can see only latest version 2025 for download.https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-downloads.htmlPlease share the link to download the developer edition for 2023. Thanks
I have an interesting case in which the reflection removal heuristic fails. This is an information plaque at the museum entry: Before reflection removalAfter the removal to my astonishment the algorithm removed the white labels, and left the top right side reflections completely unchanged: Removed labels , reflections unchanged.Thanks,Thomas
Where the heck do you report a bug? Now I know why the Adobe developers say they don't have any bugs in their queue. No one can figure how to report one.I was also told they offer free installation support. Where and how do you reach them? I've scoured the website and can't find it.
I worked for quite some time to try to create a devcontainer setup that would: Allow me to use code completion and linting Allow me to use linting Allow me to use the Security Analyzer.The first two are easy. You need a specific environment, but you don’t need to set up a server or a project. The Security Analyzer appears to require: A specific environment A server RDS, with an account. A project. Setting up a project within a devcontainer is deeply unpleasant. You have container within a container, and it appears to require you to use a VS Code project, as well as the extension’s own project files. I tend to avoid using VS Code Workspaces with devcontainers in general, because I run into conflicts between the two.I got a far as the setup below. With this and a bunch of manual setup, I think I could possibly arrive at an environment where the Security Analyzer would work, but it would be a lot of labor, and very finicky. I want something I can hand off to another developer, and the onl
I just discovered that my ColdFusion PMT 2023 server had run out of disk space on the volume where the PMT is installed (separate disk from where Windows is installed). This is a dedicated server running on Windows Server 2022.I added more space to the volume and tried to restart both the data store service and the PMT service. The datastore service will start, but the PMT service will not. The Windows Event log had no useful information about why it won't start. The PMT exception log says: [ERROR] 2026-07-17 12:38:46.675 com.adobe.pms.es.client.ElasticSearchClient - Datastore Service not available. Retrying to connect...[ERROR] 2026-07-17 12:39:19.284 com.adobe.pms.es.client.ElasticSearchClient - Datastore Service not available. Shutting down Performance Management Suite...This is even though the Datastore Service is running. Here is an excerpt from the elasticsearch log to show this: [2026-07-17T13:15:19,453][INFO ][o.e.n.Node ] [REDACTED] version[8.2.0], pid[1188],
Hi everyone,I’m working with an XML feed in a ColdFusion project where menu-related data is stored as a comma-separated string inside a single node. Each entry starts with a category or brand name, followed by multiple items, but I only need to display that first value.Example XML (simplified):<cfxml variable="menuData"><catalog> <item> <type>Drinks</type> <details>Cold Brew Coffee, Vanilla Latte, Caramel Mocha, Iced Americano</details> </item> <item> <type>Specials</type> <details>Holiday Drinks, Peppermint Mocha, Sugar Cookie Latte</details> </item></catalog></cfxml>What I’m trying to output is just the first part of each details string:Cold Brew CoffeeHoliday DrinksI assume this can be handled with string functions after parsing the XML, but I’d like to confirm the cleanest approach in ColdFusion, especially if the data grows later.This is part of a menu-structuring projec
I’m trying to import REST services from a ColdFusion 2023 server into ColdFusion API Manager. The same process works with other ColdFusion versions, but this error occurs: CFDiscoveryPortalServiceImpl - Error retrieving available REST services
Images in cfr reports are not displayed with CF 2025, no matter whether I use a relative path, an absolute path, or a file url. They were still displayed in previous CF versions.Is this a restriction of the developer version I am currently using?Any help is appreciated.
Adobe has released ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. The releases resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.View the security bulletin, APSB26-82, for more information.Download the updatesColdFusion 2025 updates ColdFusion 2023 updatesWhat’s newThis update introduces the flag -Dcoldfusion.sql.allowUnsafeTableIdentifiers. The default is False. Updates to Performance Monitoring Toolset for both CF 2025 and CF 2023. Updated add-on installersView the respective tech notes for more details.Download the updates and validate them in your staging environment. If you encounter any regressions or unexpected behavior after upgrading, report them through the Adobe support channel or your standard issue-tracking process, including relevant logs and reproduction details.
Remix with Firefly Community Gallery
Thousands of free creations to fall in love with and remix in Firefly.
Already have an account? Login
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.