But unlike recent updates, the update technotes for this one show a LOT of changes that you should be aware of before "just getting the update in place".

In fact, this update has so much to it that I am going to split this into two posts, this one that simply announces the update and points you to Adobe's several resources with more on the updates. Then I hope tomorrow to offer more of a "reaction" post. Apologies to those who prefer that in one post from me, but some of these updates are just too much for me to in one day a) consider carefully what they say, b) test them on multiple machines and OS's, c) watch what the community may be reporting about the update, d) helping clients who might have wanted to do the update the first day, and so on.

Finding more on the updates

The key first 2 are community resources by Adobe, where other folks may (over time) share feedback or observations about the update(s), which point to the last 2 (the update technotes) and more:

• Adobe CF Forum post on the update
• Adobe CF Portal post on the update
• CF2025 update 14 tech note
• CF2023 update 26 tech note

Each of the resources link to still more info about the CF updates in general and about this most recent one in particular, including downloads for the update jar file and packages zip file (for those who may need those for command-line or offline updates) as well the APSB offering security vuln details.

About the APSB, and some changes regarding it

As for the ASPB, APSB 26-144, note that it lists a whopping 32 CVEs, with 4 being rated a score of 9.9 or higher. Even so, it's classed merely as a "p2" security update.

As in past updates, that APSB also indicates that "Adobe is not aware of any exploits in the wild for any of the issues addressed in this update." To be clear, that doesn't mean you're NOT vulnerable to what it addresses.

Something else to note about the APSB is that it's formatted a little differently. Those CVE details are hidden now under a "+" sign, allowing you to expand or collapse its discussion. Note there is indeed a "expand all" and "collapse all" feature also.

One last thing of note about the APSBs comes from an email Adobe sent today to those who had registered to receive notifications about the updates. It noted first how the bulletins have a new home, https://www.adobe.com/trust/security/bulletins-and-advisories.html.

It also indicated that "Adobe is transitioning from Adobe-defined severity ratings (Critical, Important, Moderate) to industry-standard CVSS v3.1 severity ratings (Critical, High, Medium, Low), aligned with each vulnerability's CVSS score and vector string.Adobe Priority ratings (1, 2, and 3), which communicate our assessment of exploitability and patching urgency, will remain unchanged."

Much more to note, in the update technotes

Again, I plan to offer more tomorrow. Let me offer just a couple of quick points:

• Like many CF updates, this one does update the Tomcat embedded within CF server installs: the update for CF2025 now implements 10.1.60 and for CF2023 it implements 9.0.122. (That said, Tomcat implements changes very quickly, so within days CF will almost assuredly again be found to be "behind".)
• And like most other recent updates, this one addresses important changes arising from the new security protections (where Adobe has traded compatibility for security), as well as available mitigation options (mostly JVM args) where you can reverse that, to trade security for compatibility.
• In particular, see the sections on the major new "Outbound network security policy", the dozen "Security changes that require action", and about a dozen more subsections addressing different changes. Again, this one is a bit of a whopper--though most of these "dozen more subsections" are on rather obscure features that may not have been used by most devs.
• Finally, there are several "known issues" and "bugs fixed", including a couple introduced in last month's CF2023 update 25, which kept CF from starting under two circumstances.
• As for still other issues, see the "updated info" at the bottom of this post

As with each update we must balance the urgency of the update (for the security protections) against the potential changes in compatibility, along with the available mitigations (which would re-open a door that Adobe is closing in this update). Whereas normally there's not ever enough detail in the information provided to assess that, this update's technotes do contain quite a but more info (though still not as much as seems warranted on some points.)

Experience so far...

There are a couple of things to report on this first day of the update.

First, as for discussions in the community of issues with the updates, there was not much in the two primary Adoe resources linked to above.

Second, there was a CFML Slack channel thread reporting that for CF2023, its default "packages url" (https://www.adobe.com/go/cf2023_packages, which redirects to and downloads the bundlesdependency.json file at https://cfmodules.adobe.com/cf2023/bundlesdependency.json) was NOT returning any references to today's update 26 (2023.0.26). And as such, while performing a CF update would update the "core", it would not update the packages. Even worse, some found many of their packages unexpectedly uninstalled. That problem with the json file seemed to have been resolved by late night of the first day (as an update, people are still reporting it off and on into the second day).

Third, I'll share also that I found on the first startup of CF after each update that I had the following error in my coldfusion-out.log (though it did not prevent CF from starting):

I found that on restarting CF, the error did not appear again (and this was whether I had or had not cleared the felix-cache folder.)

As I learn of any other significant ramifications of this update, I may offer comments below, or an update to this post, or again I plan to do another post tomorrow with more on the many things discussed in the update.

Finally, I can say that I have applied the update on both versions, on multiple machines and different OS's, without any trouble during the update (once I confirmed that the Admin UI showed there were package updates available: I waited for that with this update of CF2023 due to the above observation).

I've also confirmed that the downloadable zip of packages offers the updated packages indicated in each update technote (there have been recent occasions where the zip did NOT include the updated packages).

Getting help, from me or others

As always, if you have need of assistance in applying or dealing with the ramifications of the update, note first that you can use those community resources above to seek help publicly.

Or I am available for remote screenshare consulting. I can usually solve most update-related problems very quickly, since I help so many people with them in each update (whether publicly or directly). See carehart.org/consulting for more on my rates, approach, satisfaction guarantee, online calendar, and more.

Updated info, since the original post

• Oct 16, 2026: There have been a couple of issues related to regular expressions (regex/regexp) that have been tracked as tracker tickets but not yet tracked as "known issues" in the update technotes. See CF-4234762 and CF-4234761. For more, see another update below of Oct 19. (If those report "no issue found", that's a bug in Tracker. It's NOT that the tickets have been deleted but instead that tracker is temporarily not working and fails to identify that correctly.)
• Oct 16, 2026: Elaborating further on a point I made in the original post, there was a problem in the first couple of days after the release, where sometimes the CF2023 bundlesdependency.json file downloaded from Adobe's site (https://www.adobe.com/go/cf2023_packages) was sometimes including references to package updates for update 26, and then suddenly it did NOT include the references. As such, someone running the update while it FAILED to have the updated package references would have trouble, which might even lead to the packages being uninstalled and not updated/not reinstalled. That problem seems to no longer be happening as of today, Oct 16.
• Oct 19, 2026: Adobe has offered a fix for some (not all) of the regex problems mentioned above. See an updated hotfix jar made available by Edwin at Adobe, in the tracker ticket at CF-4234762. See also comments from others there.
• Oct 19, 2026: The container images are available for this update, as of today, at the Adobe CF repos at dockerhub and AWS ECR
• Oct 21, 2026: Beware of the impact on CF scheduled tasks of thus update's new "Outbound network security policy". You may find that some (or all) tasks just stop working, without any indication of anything amiss in their listing in the CF Admin UI. But you may see errors in the CF logs, like the scheduler.log, which may report for example, "This scheduled task URL is not permitted by the outbound network security policy." The problem seems limited to only tasks calling urls on the local machine (which may surprise those who presumed "outbound" would mean "to off the server").

  I'd been letting this percolate in the comments but forgot that I'd not mentioned it here in the post. Fortunately, in the meantime Gregory Alexander created a helpful post on the matter, and has also commented below, on top of other helpful observations from others and myself.

  Bottom line: if you're hit with this and struggle to resolve it, note that you have choices (beyond uninstalling the update): there is the new allowlist or related blockLinkLocal and blockPrivateNetworks booleans which you can set in the update's new security-settings.json file discussed above, or you can use the new ssrf jvm argument, all mentioned briefly in the post and elaborated upon in the update technotes.

  (Note finally that while the scheduled task error message goes on to suggest application.cfc settings as another means to control things, that's incorrect. Scheduled task processing does NOT pay attention to application.cfc, not even that of an "application scheduled task". See more in my comments below of 10/16/26 2:09 PM.)

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed