Announcing ColdFusion updates of Jun 30 2026 - p1 security update - thoughts and resources
In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." Even so, in the days after there have here have been public announcements of one or more of the vulns being reverse-engineered and exploited, as I discuss below.
Even so, as happens with about 30% of CF security updates, this one has potential breaking changes (which could affect some apps but not all), and there are also new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.
Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.
Really appreciate the extra clarification you added on the XML/cfexchange changes, that saved me some digging.
Just one tiny thing: in the JVM flag list, "-Dcoldfusion.xml.saxon.allowResultDocumen" looks like it's missing the trailing "t". Adobe's Update 10 technote has it as "-Dcoldfusion.xml.saxon.allowResultDocument". Figured I'd flag it so nobody copy-pastes the wrong flag name.
Thanks again for all the resources you put out!
While my original comment here had the details, I have now moved them into the post itself, in the section, "What's the " blocked-extension list" referred to in the release notes, about cfexchange/cfpop/cfmail?", at
https://www.carehart.org/blog/2026/6/30/coldfusion_updates_released_jun_30_2026#blocked
But when the update includes package updates (as they nearly always do), those are then done during the *startup* of cf which the update process causes after the core update.
But it's that update of packages which introduces new felix-cache changes, which can lead to the need to clear that, which must happen AFTER that startup and that package update process. But that CAN'T be done while CF is now running, so they CAN'T kick off the delete process for us.
So THAT is why I recommend (as part of my post-update steps above) that we stop cf and delete the felix-cache.
Make sense? I'm open to clarifications or corrections anyone may be able to offer.
I had one last night fail to load the Administrator after install. I was too tired to deal with it so just rolled back to a snapshot of the server.
Anyone else having issues?
No, not much "noise" about it. There's a major change about cf query processing that could hit some, but it's not discussed in enough detail in the technote to know for sure. There is a JVM arg to reverse that change, if it's a problem.
There are several more sec vulns addressed, unrelated to that. So as always, updates are important, security ones are more important, and critical/p1 updates (like this one and that one) are most important.
I will also be saying in that post how we need to fear that bad guys are using the release of the update to reverse-engineer the update to find what was "fixed"...so as to craft ways to perpetrate what was vulnerable, against those slow to apply the update.
Again, I'm working that post. I hope to have it out this afternoon. I'm just one person, sometimes tugged in multiple directions. :-) And I realize you weren't complaining, just being curious.
Finally, about your failed admin, I can say I am unaware of anyone having that issue due to THIS update. It's happened (for some) with others. And as I elaborate in each post, it's incumbent on us to always a) look at the update log, to confirm no errors (as tracked at about line 77), then b) look at the bottom of the update log (about 10 lines up) to make sure any package updates successfully downloaded, then c) watch the coldfusion-out.log where it tracks PERFORMING of the package updates during the startup following the update.
If there were errors in any of those steps, you could find many things go amiss (cf won't start, admin won't work, site won't work). Uninstalling the update can get you back to working. But these logs can still help see what went amiss. Some opt to do vm snapshots/rollbacks: the problem there is you lose the logs that might explain what went amiss--but hey, ya gotta do what ya gotta do, right?
Finally, if you struggle even with that help (and details linked to in the post), know again that I can meet with you online in a remote screenshare session to guide you through and resolve whatever is amiss, often in less than a half hour. I do it with folks every week, on different CF versions at different update levels, etc. It's very rare I can't find and resolve the problem.
I looked at the JVM flag in the release notes and said what the heck? -Dcoldfusion.sql.allowUnsafeTableIdentifiers I didn't see what it meant. I look forward to your post.