But unlike recent updates, the update technotes for this one show a LOT of changes that you should be aware of before "just getting the update in place".

In fact, this update has so much to it that I am going to split this into two posts, this one that simply announces the update and points you to Adobe's several resources with more on the updates. Then I hope tomorrow to offer more of a "reaction" post. Apologies to those who prefer that in one post from me, but some of these updates are just too much for me to in one day a) consider carefully what they say, b) test them on multiple machines and OS's, c) watch what the community may be reporting about the update, d) helping clients who might have wanted to do the update the first day, and so on.

Finding more on the updates

The key first 2 are community resources by Adobe, where other folks may (over time) share feedback or observations about the update(s), which point to the last 2 (the update technotes) and more:

• Adobe CF Forum post on the update
• Adobe CF Portal post on the update
• CF2025 update 14 tech note
• CF2023 update 26 tech note

Each of the resources link to still more info about the CF updates in general and about this most recent one in particular, including downloads for the update jar file and packages zip file (for those who may need those for command-line or offline updates) as well the APSB offering security vuln details.

About the APSB, and some changes regarding it

As for the ASPB, APSB 26-144, note that it lists a whopping 32 CVEs, with 4 being rated a score of 9.9 or higher. Even so, it's classed merely as a "p2" security update.

As in past updates, that APSB also indicates that "Adobe is not aware of any exploits in the wild for any of the issues addressed in this update." To be clear, that doesn't mean you're NOT vulnerable to what it addresses.

Something else to note about the APSB is that it's formatted a little differently. Those CVE details are hidden now under a "+" sign, allowing you to expand or collapse its discussion. Note there is indeed a "expand all" and "collapse all" feature also.

One last thing of note about the APSBs comes from an email Adobe sent today to those who had registered to receive notifications about the updates. It noted first how the bulletins have a new home, https://www.adobe.com/trust/security/bulletins-and-advisories.html.

It also indicated that "Adobe is transitioning from Adobe-defined severity ratings (Critical, Important, Moderate) to industry-standard CVSS v3.1 severity ratings (Critical, High, Medium, Low), aligned with each vulnerability's CVSS score and vector string.Adobe Priority ratings (1, 2, and 3), which communicate our assessment of exploitability and patching urgency, will remain unchanged."

Much more to note, in the update technotes

• Like many CF updates, this one does update the Tomcat embedded within CF server installs: the update for CF2025 now implements 10.1.60 and for CF2023 it implements 9.0.122. (That said, Tomcat implements changes very quickly, so within days CF will almost assuredly again be found to be "behind".)
• And like most other recent updates, this one addresses important changes arising from the new security protections (where Adobe has traded compatibiliy for security), as well as available mitigation options (mostly JVM args) where you can reverse that, to trade security for compatibility.
• In particular, see the sections on the major new "Outbound network security policy", the dozen "Security changes that require action", and about a dozen more subsections addressing different changes. Again, this one is a bit of a whopper--though most of these "dozen more subsections" are on rather obscrure features that may not have been used by most devs.
• Finally, there are several "known issues" and "bugs fixed", including a couple introduced in last month's CF2023 update 25, which kept CF from starting under two circumstances.

As with each update we must balance the urgency of the update (for the security protections) against the potential changes in compatibility, along with the available mitigations (which would re-open a door that Adobe is closing in this update). Whereas normally there's not ever enough detail in the information provided to assess that, this update's technotes do contain quite a but more info (though still not as much as seems warranted on some points.)

Experience so far...

There are a couple of things to report on this first day of the update.

First, as for discussions in the community of issues with the updates, there was not much in the two primary Adoe resources linked to above.

Second, there was a CFML Slack channel thread reporting that for CF2023, its default "packages url" (https://www.adobe.com/go/cf2023_packages, which redirects to and downloads the bundlesdependency.json file at https://cfmodules.adobe.com/cf2023/bundlesdependency.json) was NOT returning any references to today's update 26 (2023.0.26). And as such, while performing a CF update would update the "core", it would not update the packages. Even worse, some found many of their packages unexpectedly uninstalled. That problem with the json file seem to have been resolved by late night of the first day.

Third, I'll share also that I found on the first startup of CF after each update that I had the following error in my coldfusion-out.log (though it did not prevent CF from starting):

I found that on restarting CF, the error did not appear again (and this was whether I had or had not cleared the felix-cache folder.)

As I learn of any other significant ramifications of this update, I may offer comments below, or an update to this post, or again I plan to do another post tomorrow with more on the many things discussed in the update.

Finally, I can say that I have applied the update on both versions, on multiple machines and different OS's, without any trouble during the update (once I confirmed that the Admin UI showed there were package updates available: I waited for that with this update of CF2023 due to the above observation).

I've also confirmed that the downloadable zip of packages offers the updated packages indicated in each update technote (there have been recent occasions where the zip did NOT include the updated packages).

Getting help, from me or others

As always, if you have need of assistance in applying or dealing with the ramifications of the update, note first that you can use those community resources above to seek help publicly.

Or I am available for remote screenshare consulting. I can usually solve most update-related problems very quickly, since I help so many people with them in each update (whether publicly or directly). See carehart.org/consulting for more on my rates, approach, satisfaction guarantee, online calendar, and more.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed