ColdFusion

We’re excited to announce the availability of Adobe ColdFusion (2023 Release) Update 25, a significant update focused on platform modernization, developer productivity, improved compatibility, and important bug fixes across the server, Administrator, packages, and integrations.The update also includes extensive OEM library upgrades, Query-of-Queries enhancements, metadata handling improvements, spread operator fixes, and updates to several ColdFusion packages.Download the update View the tech note Release highlightsOEM upgradesOne of the biggest highlights in this release is the update of numerous underlying libraries and frameworks that power ColdFusion. Update 25 includes major upgrades to components such as:Apache Maven 3.9.16 Log4j 2.25.4 Jetty 9.4.58 jQuery 3.7.1 Apache Tika 2.9.4 Commons libraries Netty components CXF services frameworkThese upgrades help improve compatibility, stability, maintainability, and overall platform security.Query-of-Queries EnhancementsDevelopers who r

NOW LIVE — the October 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. This update includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass. What’s includedThe October 2026 release contains:Tomcat upgrades. See the respective tech notes for more details. Security fixes for multiple vulnerabilities (including remote code execution and privilege escalation vectors). Updates to packages.Why you should install this updateThese fixes close high‑ and critical‑severity vulnerabilities that could be used by attackers to execute code, elevate privileges, or access sensitive data. Applying the update reduces risk to your production and development environments.Download the updatesColdFusion 2025 updates ColdFusion 2023 updatesSee the tech notesColdFusion (2025 release) Update 14 ColdFusion (2023 release) Update 26Feed

Hi All,After applying ColdFusion 2023 Update 26 (2023,0,26,331018)) to our application, I found that the ReReplace method stops matching when the regex pattern is over 1000 characters. This seems to be the new SafeRegex limit introduced in this patch https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-26.html.This has caused a bug in our application in a ReReplace method, which was using a regex more than 1000 characters long. The simple fix is to use something like Replace() instead. Alternatively, the patch mentions:-Dcoldfusion.saferegex.maxpatternlen, which defaults to 1000.Setting the flag and increasing the limit beyond 1000 also fixes the issue. My questions:Is this silent behaviour intended or is this a bug? It just returns the original string unchanged Why has a limit of 1000 been enforced for regex? Are there wider security repercussions for using longer regex patterns?Thanks 

I recently upgraded from Coldfusion 2021 Update 9 to Update 18. I used the package manager to install the update and now I'm getting the message"The Administrator module is not installed". This wasn't an issue on our test instance, but for whatever reason this happened in our production instance (lucky me). The service seems to be running. I just can't get back to the adminstrator site. I tried running the "install administrator" command on CF_ROOT/bin/cfpm.bat but it gives me the following message: "The package adminstrator is not found in the repository."

I’m curious how others are handling the removal of the old Auto-Lockdown program during or after a migration to a newer version of ColdFusion. My current migration process is roughly:Shut down the CF 2021 Windows service Run the CF 2025 installer and Migration Wizard Run the CF 2021 wsconfig to remove the web server Run the CF 2025 wsconfig to add the web serverThat all works as expected, but when it comes time to remove CF 2021 and the Auto-Lockdown tool, I’m not clear on the best way to handle that. I can uninstall CF 2021 without an issue, but when I go to uninstall the Auto-Lockdown tool it suggests it’s going to revert a bunch of settings in IIS, the current CF install, and it will remove the .cfuser account. My guess is that I need to allow it to do those things and then I’ll have to run the Auto-Lockdown for CF 2025, and unfortunately, reconfigure any permissions that were lost when the .cfuser account was recreated. Any recommendations would be appreciated. Thanks

Server Product    ColdFusion 2021Version    2021,0,23,330486Operating System    Windows Server 2019; IISWe are looking at upgrading from CF 2021 to CF 2023 and one of the first steps O have is to remove the IIS connectors via the wsconfig (ben a while since the last upgrade form CF 2016 o CF 2021, so fuzzy). We have two separate systems, a dev and a production, This is all on dev. but i get the same behavior on both instances. I made sure that Visual C++ Redistributable for Visual Studio was installed (it was, but I updated/repaired just in case). I run wsconfig As Administrator (via Explorer or CMD. I just do not get anything to pull down to remove. These instances have been moved since the CF 2016 > CF2021 upgrade, when we migrated rom Windows 2012 to Windows 2019. I am presuming the issue lies there, but not sure how to go about correcting, and do not want o just take too many guesses as we will have to repeat for production.  

Does anyone know what is the best way to run coldfusion2023/config/cfsetup/cfsetup.sh unattended without being prompted for a password (su <runtime_user>)? If I modify the script and remove “su” it runs fine but not sure about security implications.We are running on Ubuntu 24, with stand alone CF2023 servers. Looking to updated/add datasources programmatically using the gitlab pipeline and cfsetup.sh

Let's say the perfect CF developer job exists. It offers fair pay, flexible hours, and fun work. Let's say that job is snagged by an ideal candidate. All seems alright.Then they see the codebase and lack of improvement roadmap. Their eyes go wide like Gollum's. And poof, they're gone. All the pay in the world won't bring them back.An old CF app tells a story. Tidy folders, useful comments, tests, source control, and clear steps all say, "People care." A jungle of copied code, mystery files, and manual steps says, "Fly, you fools!"👉 Need more CF development help? Explore TeraTech’s ColdFusion development services. We help teams care for old CF apps, clean up messy code, and add skilled CF developers.  Developers are interviewing your appGood developers know old apps come with baggage. No one expects a 15-year-old CF app to look brand new. But they do want to see that your team can make it better.Think about two CF jobs with the same pay.  The first app has source control, a working loc

First of all, I have no coldfusion experience at all. So when answering or asking for coldfusion specifics, please try to keep your answer/question somewhat lightweight :)I’m trying to setup a minimal cfusion2025 image that runs on openshift. I currently have some issues with the image’s existing cfuser or the pod’s permissions.Dockerfile:FROM adobecoldfusion/coldfusion2025:latestUSER rootCOPY ./sources /appEXPOSE 8080 8500Pod logs:Skipping Configuration and Setting Wizardsed: couldn't open temporary file /opt/coldfusion/cfusion/lib/sedFCBEbg: Permission deniedsed: couldn't open temporary file /opt/coldfusion/cfusion/lib/sedMKjs1Y: Permission deniedUpdating webroot to /appConfiguring virtual directorieschown: changing ownership of '/app': Operation not permitted (os error 1)chown: changing ownership of '/app/index.cfm': Operation not permittedchown: changing ownership of '/app/test': Operation not permittedchown: changing ownership of '/app/test/cfm': Operation not permittedchown: chan

Hello, automated emails sent by our ColdFusion Application (Sunapsis) are failing to reach our users. Our MS Stack team suggested implementing a service account in order to meet higher authentication requirements. Has someone done this in ColdFusion?Also, is it possible we will need to setup an Azure App for OAuth authentication? If so, what documentation does Adobe have for configuring CF 2023 to use the app, client, secret, etc.?Thank you!

Have you listened to the new episode 142 of CF Alive is out? Charlie Arehart joins me to talk about moving to ColdFusion 2025 (and the sneaky Update 8, aka ColdFusion 2026).Charlie always finds hidden gems in every  release!This time we dug into:1) The new AI, MCP, and RAG stuff everyone's talking about (plus what's easy to miss past the AI headlines).2) Subscription-only licensing now. What that really costs your budget over 5 years vs old model.3) The longest "removed features" list Charlie's ever seen. If one old tag is holding your app together, you'll want to hear this.4) HTTPS on CF Admin is easy to turn on now. What Charlie still finds broken out in the field.5) Under the hood, Java 21 and Tomcat 10.1 landed together.If you're planning an upgrade from CF2018 or CF2021, don't walk into Mordor without a map. This episode is your map!See the full episode + show notes.

I'm curious if anyone testing out cf2025, that uses CKeditor has figured out what to do about the out of date messages that it produces when using ckeditor?   I will probably just convert them all to regular text areas, its just pretty annoying how its not up to date with cf2025.  I'm running a development box using the development version.  

Hello Team,These days I am facing weird issue with bulk emails delievery in my application. For example, if I am sending around 300 emails via cfmail tag, sometimes these all emails will go fine and sometimes some emails will stuck in my undelievered emails folder.I end up sending these emails manually, sometimes it gets really bad when undelievered emails goes upto 2000. Through error logs, I am able to see below error:Nov 17, 2023 07:05:09 AM Error [mailWorker-9] - com.sun.mail.smtp.SMTPSendFailedException: 451 4.7.500 Access denied, please try again later. Which is really weird, because rest all successfully delievered emails are sent via same server/using same credentials. Not sure, why it starts saying "Access denied" all of a sudden.Looking forward to hear some possible solutions from community. Please feel free to comment in case you faced similar issue in your application.Thanks,Dhanshree Joshi

Has anyone else experienced problems implementing CF23 update 24 where it seems to be complaining about the colon in the dbvarname. The procedure name is just PACKAGE.PROCEDURE_NAME I don't see the cause of the problem. Actual error: The value ":v_session_id" contains invalid characters. cfprocparam dbvarname=":v_session_id" value="#functionHere()#" type="IN" cfsqltype="cf_sql_varchar"

NOW LIVE — the September 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. The updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.What’s includedThe September 2026 release contains:SQL table and stored-procedure identifier validation New SQL validation opt-out flags XSLT collection() and uri-collection() blocked New XSLT compatibility flag AJAX widget HTML input sanitization guidance Configurable deserialization limits Package updatesDownload the updatesColdFusion 2025 updates ColdFusion 2023 updatesSee the tech notesColdFusion (2025 release) Update 13 ColdFusion (2023 release) Update 24Feedback and supportAs always, if you encounter issues after updating or need assistance planning your rollout, contact support or reply to this post with details. Your feedback helps us prioritize follow‑up fixes and c