Announcing ColdFusion updates released Apr 14 2026 - p1 security update - thoughts and resources
An update for ColdFusion has been released, Apr 14 2026, for each of cf2025 (as its update 7) and cf2023 (as its update 19). In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
(This is the second update since CF2021 has reached its end of life as I blogged previously, which is something folks running that should beware. You are now QUITE exposed to things fixed in these two updates, for which there is no fix for you.)
In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update.
For more, read on.
https://www.carehart.org/blog/2026/4/14/coldfusion_updates_released_apr_14_2026#felix
where I conclude:
"While it's true that updates in early 2025 started doing a delete of the felix-cache folder as a FIRST step in the update process, that doesn't help if the update did update packages, in which case it's wise to delete it again AFTER the update, as discussed here. Again, this is just a recommended practice from my experience helping with hundreds of CF updates, not something Adobe mandates.)"
The mail package is not installed.
You can install package through CLI package manager (D:/ColdFusion2023/cfusion/bin/cfpm.bat) by running the command : install mail.
And then when I go to install mail, I get this:
cfpm>install mail
The packages repository https://www.adobe.com/go/cf2023_packages is not accessible. You can only load the packages that are available locally in the D:\ColdFusion2023\bundles directory.
The following packages will be installed : mail:2023.0.11.330706
mail(2023.0.11.330706) package is already installed.
Those who suffer problems have specific challenges, often unique to them.
And I have never heard of the scenario you describe, where a restart after the update resolves a seeming package install problem. To be clear, the update mechanism is SUPPOSED to restart cf itself. And I always tell people to check the coldfusion-out.log after the update to observe the messages after that restart, to ensure all went well.
I can offer this: we can resolve this problem in a shared desktop session. If we don't, you won't pay for the time (which I track in as little as 15 minute increments).
Is solving this problem important enough for you to do that? If so, find and grab a slot (even today) in my online calendar. For more on my rates, approach, satisfaction guarantee, that online calendar, email, phone, and more, see the consulting page at carehart.org.