Announcing ColdFusion updates released Dec 9 2025 - p1 security update and more
An update for ColdFusion has been released, Dec 9 2025, for each of cf2025 (update 5), cf2023 (update 17) and cf2021 (update 23). This is in fact that FINAL update of CF2021, as it has reached its end of life as I blogged last month.
In brief, this update (for all 3 versions) ad.dresses several P1 (Priority 1, "Critical") security vulnerabilities, and also updates Tomcat, along with updating several CF packages, and makes some other changes (see below). Note that Adobe is also reporting currently that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update.
Having installed the update for each of the releases on multiple machines, I can report that it went well expect for this:
Warning: on CF2023, after applying the update, I and others have experiences that the CF Admin is inaccessible and packages that were updates are unexpectedly uninstalled. I will offer a follow-up post on that, including how to solve the problem (until Adobe does), and how to ensure your own manual efforts to solve it are complete.
There are no comments for this entry.
[Add Comment]