Announcing ColdFusion updates of Sep 8 2026 - p1 security update
Adobe has released another set of updates today, Sept 8 2026, for CF2025 (update 13) and CF2023 (update 24). As with other recent updates, these "resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure."
First, he's referring to https://tracker.adobe.com/#/view/CF-4233544, which was a bug introduced in the previous update, which had updated tomcat. After that, cf instances that were set to use cf's cluster and session replication feature wouldn't start. Adobe offered an updated catalina.jar there, which fixed the problem. Jeff's now asking if that change made it into this update.
I'll say there were no "bugs fixed" listed in the technote. And I don't make a habit of checking all outstanding bugs (that may have fixes offered via tracker) to see if they were rolled into an update. :-)
But it won't surprise me if they did NOT incorporate this change (the updated catalina.jar), because such security updates tend NOT to incorporate bug fixes. It seems they are pressed (by the Adobe PSIRT folks) to get the sec vulns fixed ASAP. As such, my sense is that they withhold bug fixes--even existing ones--to keep the impact of the update limited to those changes due to the security protections.
I've seen them wait more than one cycle of updates before rolling bug fixes (and perhaps feature changes and even sec fixes) into a later update.
That's frustrated folks who found this stance also meant that known tomcat vulns remained unresolved, because Adobe didn't roll that into some sec-only update.
I'm just an observer. I have no sway on their decision-making.
Last, note that it's possible that while the update didn't APPLY that updated catalina.jar, it also likely would not have touched it. So if you did apply the update, the changed file may remain.
If you or anyone gets to check, I'd love to hear. I don't want to promise I will get to check. Juggling a lot right now.
Hope that's helpful.
Second, I did not have that updated jar in place when I did my updates earlier this week, but I can say that I see the catalina.jar listed in the hotfix_filelist.log, within the hf-updates folder for the update. And I ALSO see the file in the \backup\runtime\lib folder within that hf-updates folder for the update.)
As such, I would expect that the updated file (put in place from tracker) WOULD have been replaced by the update. That said, it does mean one could easily recover it from that backup folder (or it can be obtained again from tracker, of course). One would then need to restart CF for that change to take effect.
And while I was looking at CF2025, I'd expect the same with CF2023 (though to be clear, Adobe offers a different catalina.jar in tracker for each CF version. Don't cross the streams!)
Finally, it is indeed lamentable that the tracker ticket lists the bug as "fixed". If you look closely, though, what it shows (for 2025) is that the "fixed in build" is 2025.0.12.331938. To be clear, the update technote for update 12 had indicated its version was 2025,0,12,331922 (which is BELOW that). We've not had an update that takes us to THAT version.
And while this week's update takes us to 2025,0,13,331960 (clearly "above" that), again we don't have it fixed.
More interesting, I am noticing now that the tracker ticket DOES list TWO different versions for CF2023's "fixed in build": 2023.0.25.330965, 2023.0.23.330946
So that suggests they plan for it to be implemented in an update 25 (of 2023). They just failed to list there that seemingly for CF2025 i would come in an update 14, yet to come.
HTH.
/Charlie, your friendly tea-leaves reader...
That's not saying all ran smoothly. The odd thing with this hotfix that I noticed is that with most of the upgrades to HF 24 on my instances, I had to reinstall the FEED package because it was uninstalled for some reason. I had to install the .21 version but there is a .25 version since that hotfix is now released. I also had to install the administrator through cfpm.bat randomly on some but not every instance. Strange happenings but I seem to be okay.
Of course, a month later update 25 came out. We'll see how things go for you and others dealing with that session replication issue, when you may apply that.
Finally, as for your issues with the feed package, I can say that I am not aware of any common problem (about that package specifically) that has been happening to folks.
There can be all kinds of reasons that one or more packages fail to get installed. I have discussed many times in past blog posts (about updates) how it's critical that folks watch the logs after an update--both the update log itself (which is where downloading of the package updates is tracked, at the bottom) and then in the coldfusion-out.log (in the lines tracking the startup of CF after that update).
It's during that first CF startup after the update that any package updates are attempted (first showing "uninstalling" for each package to be updated, and then showing "started" for each package installed--no message tracking "updating" or "updated").
To be clear, that package update mechanism ALWAYS starts by removing what it thinks it needs to update. The problem is that if there's any FAILURE to do that update (which WILL be logged there), it does NOT have a process to roll back, reinstall, etc. And so folks are left with some packages uninstalled.
The answer is always in the logs. And sometimes the root cause is something you can control. There are too many possibilities to list them all. But I can help those who feel it's a convoluted mess that they can't figure out.
I won't be surprised if it's it specific to the feed package but somehow happens to another, or none at all.
Good for people to be reminded to watch out, yep.