Announcing ColdFusion updates released Jan 13 2026 - p1 security update
In brief, this update (for both versions) addresses a P1 (Priority 1, "Critical") security vulnerability, related to the Apache Tika java framework which Adobe embeds for certain processing with CF.
Before proceeding, it's of some concern to note that unlike recent CF security updates, Adobe does NOT report (in the APSB, linked to below) that they are, "not aware of any exploits in the wild for any of the issues addressed in these updates." That omission would seem to imply that they ARE aware of this vuln being exploited, which raises the urgency of getting it applied. (It also raises the concern all the more for those on CF2021 or earlier, for whom Adobe will no longer offers ANY updates, including security updates.)
In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update.
For more, read on.
https://coldfusion.adobe.com/2026/01/now-live-coldfusion-2025-and-2023-january-security-updates/
I'll revise my post now to add that, leaving these comments to explain to anyone interested in the curiosity.
To be clear, the update technotes were telling us to do that manual clearing of the felix-cache even AFTER the updates that started doing that "for us"...and people WERE indeed reporting that it fixed problems.
That's why I regard it simply as good hygiene. It would NOT be the first thing that the technotes failed carry forward from one update technote to the next. I'll be happy when it's proven that it's no longer ever necessary.