Announcing ColdFusion updates released Apr 14 2026 - p1 security update
An update for ColdFusion has been released, Apr 14 2026, for each of cf2025 (as its update 7) and cf2023 (as its update 19). In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
(This is the second update since CF2021 has reached its end of life as I blogged previously, which is something folks running that should beware. You are now QUITE exposed to things fixed in these two updates, for which there is no fix for you.)
In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update.
For more, read on.
https://www.carehart.org/blog/2026/4/14/coldfusion_updates_released_apr_14_2026#felix
where I conclude:
"While it's true that updates in early 2025 started doing a delete of the felix-cache folder as a FIRST step in the update process, that doesn't help if the update did update packages, in which case it's wise to delete it again AFTER the update, as discussed here. Again, this is just a recommended practice from my experience helping with hundreds of CF updates, not something Adobe mandates.)"