Announcing ColdFusion updates of Jul 14 2026 - p1 security update - thoughts and resources

I've always installed hotfixes by downloading the hotfix and packages repository manually, extracting the updated packages repository, updating neo_updates.xml to point to the new extracted package repository, then installing the hotfix via admin command prompt.

Everything has always worked without any issues.

Confirming a few things though that have always seemed odd to me:

1. With my process described above packages are updating themselves during the hotfix install, no? Seems like it does for me - I see the installed package version numbers climbing over time. Back when the packages repository process was introduced I was baffled as I assumed I would have to install package updates manually post hotfix-installation. I run "check updates" and it returns no updates.

2. If a hotfix (example: 2025 Update 11, "331909") has a technote indicating that a certain package (example: administrator) was updated should the current version of said package in ColdFusion administrator not always reference "11" in it somewhere? I have many packages installed with version numbers containing "08" or "10", even though later hotfixes have apparently included package updates - such as Update 11. I'm looking at the bundlesdependency.json file included in the Update 11 packages repository and seeing no instances of a version number containing "2025.0.11" anywhere, nor any references to "331909".

Christopher, if you use the Java -jar command to do that manual install, then it works as I describe above, which is the same as the CFAdmin, in terms of the diagnostic approach I discuss.

If instead you do the same cfpm command to update the packages then those are indeed done when you do that (just like if one updates packages within the cf admin)...though as you may know, both will still indicate that some package updates (or installs) require a cf restart, and that's when some aspects of those are processed during that startup.

To your final point, you certainly could still see older package version numbers being installed, given that some packages are not often updated.

But you seem to be saying that you find NO packages having been updated to 11, even after updating cf2025 to update 12. That's certainly a problem. At a minimum, the administrator package should be at 11 since it was one of the packages updated.

And to that, I'll go back to my previous paragraph: have you restarted cf after doing those package updates (if done manually via cfpm)? And either way, have you checked the coldfusion-out.log to view what was tracked during that Cf restart? See the links offered to my other post with more detail on checking for that.

Let us know what you find.

Hi Charlie,

I've definitely been checking on-server.

The packages repository for CF2025 Update 11 (on the technote, here: https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2025-release-update-11.html) does not seem to have any "version 11" package updates within it.

Unless I'm crazy and am just missing it. The latest version for some packages within it is "10", despite the technote claiming that CF2025 Update 11 contained updates for several packages.

Charlie,

We'll probably post at the same time again (doh), but I think I discovered the issue. The technote's downloadable packages repository (URL shared above) does not align with the one Adobe hosts:

https://cfmodules.adobe.com/cf2025/bundlesdependency.json

So I'm guessing those who update via CF administrator got all the updated packages, but those of us who manually update didn't.

So on your next comment, you say that the packages repository you found listed on that update technote does not indicate any version 11 updates. Let's clarify for folks. The repository/json file is within the zip offered on the page you listed, and its url is:
https://cfdownload.adobe.com/pub/adobe/coldfusion/2025/packages/hotfix-packages-cf2025-011-331909.zip

Or you can get it directly from this URL, which is what the CF Admin (and that neo_updates.xml) would point to by default:

https://www.adobe.com/go/cf2025_packages

And that does a redirect on the Adobe server to this:

https://cfmodules.adobe.com/cf2025/bundlesdependency.json

And it's THAT json file which should have references within it to 0.11. And it does for me. As I said in my last comment, the 9 packages WERE updated to 11.

So to clarify, is that the URL you're using?

And are you trying to visit that using a cfhttp, for good measure (because what you see in your own machine or even a browser on the CF machine may respond differently when visited from within CF).

But if that still has no references to update 11, then I will assert that this issue is a caching issue, somewhere between your server and Adobe. I mentioned that in the blog post itself, saying that can happen for some people.

And it may well affect also the zip, which was the first URL I offered. But note that that specifically references update 11, so I would be VERY surprised if that had no references to 0.11 in it.

So assuming you confirm that zip is fine, the problem may be down to your machine/cf/your command line returning a cached version of that json file. Indeed, note that the manual step discussed in the technote refers to how some need to "Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder."

Here's a simpler thing to try: change the URL in that line (or in the CF Admin, using the "package manager" and its "Settings" tab at top) so that it's this, instead:
https://www.adobe.com/go/cf2025_packages?1

Note I am adding a ?1 to the end (a query string value). That will trick the browser (or cfhttp) and then everything in the path to that server to regard that the URL is a "new one" (just adding a new querystring that it would never have seen before). BTW, the redirect on the Adobe server to go to that next URL (https://cfmodules.adobe.com/cf2025/bundlesdependency.json) will ALSO pass along that modified query string. Does that now return the updated file?

If so, great. We can't easily know where in the path between you and there that it was cached. Don't presume it's Adobe's server. It could be caching mechanisms on your machine, in your network, in the CDN network Adobe may use, or finally Adobe's server.

Anyway, if it does work just know that if it happens again on the next update, you'll want to change querystring...just change ?1 to ?2.

Should you have to? No. Virtually no one ever reports this. I've helped people do literally several hundred CF updates since CF2021 introduced the package manager. It's a very small number of folks who report problems like this, and note that it isn't even every update for them.

I really think they're just victims of unfortunate circumstance...but if they don't know (don't consider) all that we've discussed in these comments, they would easily feel "CF is broken" or "Adobe sucks" or any other common aspersions.

Again, let us know how things go.

OK, thanks for all that. You've indeed found what's amiss. I have more to offer. (Sorry for the walls of text tonight, folks. But we need to do such digging to get to the bottom of problems. Not really suited to slack, twitter, etc.)

Before I address what you've found, I want to say first that I do stand by all I wrote in that last note (and the one before it--and I hope you see now how that previous comment of yours was not "the problem", as I said). And I hope all this so far may benefit others who may read it.

And actually, I HAD downloaded the zip to look into this very issue while writing one of my earlier comments...but then I saw your comment while I was writing, which distracted me, and I forgot to finish that task. :-(

Had I done it, I would have found what you did. Yes, the problem is that the zip--even downloaded tonight--has a bundlesdependency.json file that has somehow NOT been updated to contain references to the update 11 packages.

Worse than that, it none of the updated jars that would go with those updated packages. It is indeed seemingly that Adobe made a mistake in creating that zip. (I'd mentioned above that since it had a NAME that referred to the update number, it wouldn't likely be cached.)

I'll add further that I tried my trick of adding ?1 to the end of the URL for the zip (which I had never visited before, using that ?1), and the zip I got STILL exhibits this problem.

So what can be done? Well, Adobe won't likely see this conversation. One of us has to bring it to their attention. Have you already, perhaps?

As for what YOU can do, I'd asked more than once: did you use the "java -jar" approach to do the manual update or the "cfpm update" approach (and was that "cfpm update all" or "cfpm update packages")?

Also, are you doing the manual install because you don't have internet access on the CF machine? And is it that you have no proxy, which you could then configure in the CF Admin package manager "settings" page?

Or if it's firewalled, is it that you you can't get that opened to allow CF to reach the domains pointed to by the two default url's in that cf admin package manager "settings" page, and the URLs they both redirect to?

I press this point first because sometimes people don't realize there are those options for configuring CF to use a proxy or to open a firewall to just those URLs.

But second, sometimes people DO have internet access from the CF machine (and CF), but they don't use the admin to do updates because it "always fails". And in that case, the problem is nearly always that they have changed the CF service to run as a different user (good for security), but that user doesn't have authority to stop/start the CF services. And the update fails because of that.

I've shared in various places before that on Windows, the wonderful solution for that is a free tool from Core Technologies called "Service Security Editor". Once that's solved, then the CF admin update "just works" in nearly all such cases.

BTW, I did a blog post last year on a problem very SIMILAR to this (the bundlesdependency.json file in the zip was not being updated...but it differed in that people were finding that ALL packages were uninstalled, and even the Admin did not work. In that case, the jars within the zip WERE updated but it was only the json that was not.

FWIW, that one is at https://www.carehart.org/blog/2025/12/10/applying_cf_updates_may_uninstall_packages_unexpectedly
But that's not the issue in this case (since the jars in the zip are not updated).

Anyway, I'm just wanting to help you (and others) get that update implemented. Again, let me know what you think (and whether you've informed Adobe of the issue).

Hi Charlie,

I indeed stepped away for a well-deserved walk outside.

First, thanks for confirming my findings were correct, and that I wasn't going crazy. I've been doing offline/manual updates for many CF versions now and have never run into any issues where the downloadable packages repository wasn't updated correctly.

As for why I do the offline/manual update, it's just habit from the older days when CF administrator (at least for me) wasn't always reliable, or from prior workplaces where outbound internet was fully restricted. I honestly prefer the offline/manual install ("\jre\bin\java.exe -jar" on the manually-downloaded hotfix), [at least I feel like] I get better visibility of what's happening.

Second, thanks for submitting a bug report to Adobe. I planned to do that as well post-walk, but you beat me to it!

Here's hoping people either caught the issue ahead of time, are not doing offline/manual updates, or Adobe fixes this quickly.

Thankfully for me my CF2025 server is a new server I'm building, so it's not in production yet and I've got time to fix this.

I guess my offline/manual update process will now include one extra step going forward: checking Adobe's package repository contents beforehand to ensure it is correct. Only takes a few extra seconds, but at least this won't surprise me again in the future.

Have a great night!

Yep, and I have news to share:
- First, Adobe support had responded overnight saying that they appreciated the heads-up and were working on it.
- Better news: while I was writing this note (and to say it was still not done), I found that JUST before sending it, it WAS now updated. Yay! It has the updated json and several new/changed files within the zip all in support of the update 11 page updates.
- If you may try to download it, do consider using another querystring value to try to circumvent any caching between you and them
- Of course, beyond just fixing this current problem we can hope they will somehow undertake steps to prevent it happening again (but sometimes that hope proves illusory)
- Some might think it could be nice if they would add a checksum for the zip on the technote page, so we could more readily tell if it was changed (during the life of the release of the update, like this situation). But I'd counter that even if that DID happen (and they modified the html for that technote page), that page could ITSELF be cached (on your browser, in your network, etc.) such that one could be left thinking "they still haven't changed the file!". That's why, for now, I just recommend we vary the querystring to determine if/when they may change it.
- Finally, I too will try to remember to undertake watching out for this situation when I do my normal testing of a new update, before writing a blog post announcing it. Since it's happened similarly (not the same) at least once last year, it's worth our watching out for.

In one of my previous comments this morning, I suggested that while Adobe might add the checksums to the update technote, that could itself be troublesome if they changed it but we might see a cached version of it for some time.

Well, I happened to find out right after that they DO offer the checksum for the zip files...not on the update technote itself, but rather on the page that lists all updates for each version, such as all those for CF2025 or for cf2023:
https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2025-updates.html
https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html

Just sharing that for any really interested in this discussion Christopher raised. Apologies for those unaffected by it.

It's all limited solely to those who a) do a manual offline update that includes b) downloading the packages zip and handling that. It does not affect those who do the update via the Admin, or those who do it via the java -jar command, and who are able to rely on those update processes to download the package updates in a way that does not get affected by this issue.

Thanks. And you raise a good point: they really do need to announce that correction, as otherwise folks may not notice (like Christopher did, initially here) that they do not have the updated packages after such a manual update using the original zip.

I'll also contemplate a post on the matter.

Also, to Chistopher and Jim and others who did the manual offline update, while you may have done the "java -jar" to implement the update (which failed then to update the packages), now that you have the updated zip and have extracted it (and assuming your neo_updates.xml or the CF admin settings page with that value points to that updated zip), you could just run the "check for updates" in the CF Admin (and then do update all) or run the "cfpm update all" command. No need to "rerun the entire update".

Thanks for clarifying, Christopher. And glad it worked out. And sorry I missed your previous comment. Yep, really glad you stepped in last night to press the point.

Let's hope some will be benefited here (like Jim) but more than that, let's hope Adobe somehow spreads the news. I just pressed them about it, in reply to the discussion about how they'd fixed it this morning.

FWIW, Ben raised this issue in the cfml slack after posting this comment...and given the nature of slack notifications I saw and responded to that there, before seeing notification of his comment here.

For now I want to point interested readers at that. We have not yet resolved his problem there, but you'll see suggestions from myself and others:

https://cfml.slack.com/archives/C06TABBT8/p1784813286235619?thread_ts=1784813286.235619&cid=C06TABBT8

And I appreciate of course that not everyone seeing this uses slack. Hopefully when Ben has found resolution, he or I or someone else may offer an update here.

But unless you have what you KNOW to be the answer (which we'd welcome here and there), please hold off offering HERE just guesses and diagnostic ideas, as several have already been proposed there. :-)