In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." Even so, in the days after there have here have been public announcements of one or more of the vulns being reverse-engineered and exploited, as I discuss below.

Even so, as happens with about 30% of CF security updates, this one has potential breaking changes (which could affect some apps but not all), and there are also new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.

Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.

(I have updated this post since its original release. See the list of changes at the bottom of this post.)

Quick overview

See below for the breaking change impacts on cfexchange and (separately) some aspects of xml processing. There's also a related discussion of cfpop/cfimap receiving of attachments. I add info about the "blocked extensions list" not found in the release notes. See as well an available jvm flag/arg related to both of these.

There's also a change (not a "breaking" one) for CF2025 related to its new AI feature and MCP client operations specifically, regarding authorization, also covered below.

Beyond that there are no bug fixes or known issues indicated for this update, at this writing.

Note also that this update is indeed different from the other update for CF2025 and 2023 earlier this month, which I discussed in a post that day, June 9.

Like with each CF update, I share the details about the update (from Adobe and from others) as well as additional info you may want to consider before (or after) doing the update.

(And FWIW I'll note that I have installed the update for each of the releases on multiple machines, starting from different update levels, and on multiple OS's, and I can report that it went well with regard to performing the update itself. As for whether your apps will be affected by the update, or others you may be skipping, I can't speak to that other than to offer the info about the update itself, below.)

Details on the update, applying it, and more

Following are the topics discussed in this post:

• Finding the update (and more about it)
• What are the security issues addressed in the update?
• What's changed in the update?
• Packages updated in this update
• Additional info to consider before/after doing CF updates
• On getting help with the update(s)

I appreciate that some people look for my posts as a go-to resource about the update, and some may wish I'd gotten this note out earlier today (the day of the update's release). Beside testing on multiple machines, I also take time to consider feedback shared in the community, or things I may learn as I offer help to them and my own clients. (So far, again, I'm not aware of any issues with the update itself. That said, sometimes issues may arise due to caching--with respect to "seeing" or downloading the update. Only time will tell, but such problems inevitably do pass.)

Finding the update (and more about it)

You should find news of the new update in your CF Admin upon login (assuming "check for updates" is enabled in its Package Manager "Settings" tab, or if you click the "check for updates" button under the "Core Server" section of the Package Manager page). If you don't find it there, even today, again give it time as there may be caching issue.

Otherwise, Adobe has announced the update via their CF Portal, specifically these:

• Adobe Portal/blog announcement of the update

(Curiously, there is still no post for the update in the CF Community Forums, where often there tends to be more "discussion" from community members.)

And each such announcement points to the very important update technote available for each version:

• ColdFusion (2025 release) Update 10
• ColdFusion (2023 release) Update 21

BTW, note that the URL for these technotes has changed: I find currently that trying to use the older "helpx" URLs for the previous updates (such as for CF2023 update 19) and incrementing the update number in a 404 error. The docs now use "guides.adobe.com" rather than the "helpx.adobe.com".

Finally, as forgetting notified by email about CF updates, see the discussion below, How to get notified of updates by email, among the closing points about "additional info" on updates.

What are the security issues addressed in the update?

As I indicated at the outset, this update is focused primarily on security. Quoting from the update technotes, the update "resolves critical vulnerabilities that could lead to arbitrary code execution, privilege escalation, and security feature bypass."

As for the CF aspects of the security vulnerabilities, see both the update technotes above and the Adobe Product Security Bulletin (or APSB) for this update, which indicates how it's indeed a Priority 1 "Critical" update, with the various CVEs listed in the bulletin range from having a CVSS score from 6.5 to 10.0 out of 10 (with 6 scoring 10.0). The bulletin clarifies the specific NIST CVEs addressed.

You can read the bulletin for the boilerplate identification of the issues, and the CVE documents. Sadly, as is nearly always the case, there is very little detail beyond that about the vulns, and certainly no information to help you "detect if you're vulnerable". The expectation is that "you are" (vulnerable) and therefore "you should apply the update" in order to get the protection it offers.

News of vulns being exploited

That said, some of the discussions lack subtlety: for instance, two of the most dangerous-sounding exploits affect things which are disabled by default for 10 years or more (access to the CFIDE folder--which has been blocked by the wsconfig tool since cf2016, and RDS, disabled by default since cf10 at installation if using the "Production" profile).

I offer more comment about this where I can in the resources linked to below. As I also note there, I'm not saying these things to discourage applying the update. I've said from the outset that this is a p1/critical security update. I'm just adding clarity that seems important.

Even so, one of the 3 listed exploits discussed involves the ckeditor integration buried within the cfscripts folder. That currently would affect everyone, it seems. Anyway, we should always endeavor to apply cf updates ASAP.

Some of the resources discussing things are:

• Watchtowr article identifying efforts and exploits (no comments allowed)
• Reddit post about the watchtowr article (with a comment I added) /li>
• LinkedIn post about the watchtowr article (with a comment I added)

Now back to the rest of my original post.

What's changed in the update?

Beyond that, there is still more about the security aspects of this update which, like about 30% of recent CF security updates, has introduced some breaking changes (where Adobe is sacrificing compatibility for the sake of security), which will impact some (but not all) CF apps.

Changes regarding cfexchange, cfpop/cfimap, and xml processing, in CF2025 and CF2023

The changes in this update affect:

• those using cfexchange (and related tags), including app-level and server-level control of the changed behavior
• a related impact on cfpop/cfimap receiving attachments (including a tag-level and server-level control of the changed behavior)
• those using the xmlsearch() and xmltransform() functions

See the technote for more on each of those, including the app-level and server-level control I refer to. The technotes also indicated how for each of those there are jvm args (aka "JVM flags") which can revert the behavior, if desired. If used, those are settable in the CF Admin "Java and JVM" page or CF's jvm.config file). The new/updates flags are:

• -Dcoldfusion.attachment.allowblockedextensions (this is related to the first two bullet points above, while the rest relate to the 3rd one)
• -Dcoldfusion.xml.saxon.allowResultDocument
• -Dcoldfusion.xml.saxon.allowUnparsedText
• -Dcoldfusion.xml.saxon.allowDocFunction
• -Dcoldfusion.xml.saxon.allowEnvironmentVariable

For more on each of these, see both the update release notes.

Note there is also an available document listing all the JVM args as added per different updates to CF2025 and CF2023:

• CF2025 JVM args doc page
• CF2023/2021 JVM args doc page

What's the " blocked-extension list" referred to in the release notes, about cfexchange/cfpop/cfimap?

After posting this entry, commenter Jeff Horne asked about what Adobe meant when referring (in the technote) to a "blocked-extension list". I honestly hadn't yet looked that closely into things, but his question did prompt me to investigate. Here's what I reported to him below, but I want to move it here for everyone to more readily see.

The "block list" they refer to is in fact the very same one that's been in the CF Admin for a few releases. It's under the first "Server Setting" button, in its first "Setting" menu at the top. On that page is a section, "Blocked file extensions for uploads and attachments" (emphasis, mine). Before this update it was just called, "Blocked file extensions for CFFile uploads".

And below that it now says:

"Specify a comma-separated list of file extensions to block when ColdFusion saves files from CFFile uploads, cfpop /cfimap email attachments, and cfexchange attachments. * (Wildcard) denotes blocking all such file saves and :no-extension denotes blocking files that have no file extension."

Whereas previously it said just:

"Specify the file extensions as a comma-separated list, which gets blocked during file uploads using CFFile tag. * (Wildcard) denotes to block all file uploads and :no-extension denotes to block uploads of files having no file extension."

So clearly this is "the blocked-extensions list" referred to in the technote, and clearly CF has been modified internally to use this list for the new default blocking of cfexchange attachments.

And folks should note that this also affects receiving of attachments via cfpop and cfimap, as was discussed in the technote. (What's not clear from the technote is whether this change for cfpop/cfimap is itself new in this update. They refer to it there merely with, "the documentation for cfpop and cfimap tags has also been aligned to reflect existing support for this attribute." If I can confirm it was a change in this update, I will revise this paragraph.)

And to be clear, the form field for this blocked extensions list as offered in the admin does indeed allow defining a list of extensions (which one can modify) or which can be changed to *, at your own risk.

Note also how there is a "restore default extensions" button there. I can tell you that with both the current update and the previous ones, that default list (if restored) is this:

AS,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,DMG,EXE,HBXML,JSP,JSPX,JWS,MXML,PHP,SWC,SWS,CLASS,JAR,ASMX,ASHX

That said, I found that before restoring it (with an instance where I'd never changed it), the list appeared different, but it is just in different order:

AS,ASHX,ASMX,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,CLASS,DMG,EXE,HBXML,JAR,JSP,JSPX,JWS,MXML,PHP,SWC,SWS

Bottom line, here is the "default list" (if restored) and if sorted:

AS,ASHX,ASMX,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,CLASS,DMG,EXE,HBXML,JAR,JSP,JSPX,JWS,MXML,PHP,SWC,SWS

So you can leverage that button or use this list, to block what you want or not. Of course, what's returned as the "default" list may well change in future versions/updates, of course. I don't make the rules...I just observe and report what I can about them. :-)

Changes regarding an aspect of CF2025's AI functionality, MCP client authorization

Note finally that the CF2025 update has changes related to the optional new AI functionality (available only with CF2025), including a change regarding MCP Client operations, where STDIO MCP servers now support three levels of command authorization.

Packages updated in this update

As is the case with many of the CF updates, this one does include updates to a few of its packages. See the table at the bottom of each technote indicating what packages were updated (which differs slightly between the two versions).

(As I noted at the outset, this update incudes no other changes, bug fixes, or known issues, as documented in the update technotes at the time of this writing.)

Additional info to consider before/after doing CF updates

Finally, just as with ANY CF update, there are a few issues you should keep in mind. Some have to do with things you should consider BEFORE doing any CF update, while others relate to considerations AFTER the update is applied.

I used to cover them within each of these posts, but I have tried to avoid repeating them. I'll say again that I plan to create a new post pulling the points out to stand alone (as like a best practices for CF updates). But until then, look first at the closing sections of my Apr 2026 update post:

• Things to beware BEFORE doing any CF update
  • Changes, as a result of any CF updates you may be skipping
  • Beware also that if you'd modified the pathfilter.json file introduced in the May 2025 CF update, sadly that file will be overwritten
• How can you assess if the update went well?
  • 1) Check the update log, both for success applying the update
  • 2) Check that same update log, for success in the update downloading any updated package
  • 3) Check the coldfusion-out.log for success during UPDATING of any packages
• A few other topics generic to recent CF updates, which you may want to consider
  • You should strongly consider "clearing the felix-cache"
  • Other update topics to consider

And then there were still other generic update topics which I'd covered in still previous posts, the last one in my post on the Oct 2024 updates. After that I started having my subsequent posts point people instead to the bottom of that post for these equally important topics:

• What to consider, with regard to some previous CF updates (possible breaking changes)
• As with all CF updates, possible need to upgrade web server connector
• Something to consider, if you're updating CF2023 from its update 4, or earlier
• and more

How to get notified of updates by email

One last generic topic, not currently covered in those two posts, is that if you may prefer getting notified by email about such CF updates, there are multiple options for that:

• Adobe offers a free service for you to be notified by email regarding any security updates. You can limit it, of course, to only CF. (It does not notify you about non-security CF updates, though.)
• In the cf admin Package Manager page, note there's a Settings tab at the top, and one of the configurable settings it to provide an email address/addresses to be notified by your own server. This assumes the CF admin Mail page is properly configured with an smtp server to deliver the email.
• Pete Freitag offers a wonderful (paid) service called HackMyCF, which despite the scary-sounding name checks regularly to let you know if you are not keeping up on CF security configuration matters, including updates and much more. (Indeed, it will warn if your cf configuration exposes the RDS feature as well as the CFIDE and cf_scripts folders which the news reports above say are being exploited if this June 30 2026 update is not applied.) Another key benefit, though, is that he also sends an email to hackmycf customers indicating when cf updates are released, usually the day they come out.
• And I, too, try to post about updates the day they come out. You can follow my rss feed or easily subscribe to get email notification of posts. See the simple form and rss feed link offered at the end of each post.
• CF hosting companies tend to share an email to their clients when updates come out, including VivioTech, xByte, and others.

On getting help with the update(s)

Finally, as for getting more help with the update, you have a few options.

First, you can reach out to Adobe via the post(s) announcing the update which I pointed to above. Adobe folks might well respond to issues you raise there. Or you could reach out to their support email addresses: [email protected] or [email protected].

Next, you can also reach out to the wider CF community for help or to hear from others. Note that I offer links to several of the online CF communities here.

Finally, if you may want help with considering, installing, or troubleshooting anything related to these updates (or indeed anything related to CF), I'm available for online remote consulting. I can often help solve such update problems VERY quickly (often minutes, rarely even hours), getting you back on your feet. More at carehart.org/consulting.

• Within a half hour of originally posting, I decided to add a bit more clarification about the changed behavior in the update, rather than just point to the technote for it. I'd added a couple more introductory paragraphs and the later "what's changed" section. (I'd had these in previous updates which introduced breaking changes, but since the last couple did not, I was lulled into not detailing them but thought better of it right away.)
• The next morning I added more about the "blocked extension list" (impacting cfexchange attachments) as well as how it affects cfpop/cfimap. The release notes make passing mention of this, but a question from Jeff in the comments prompted me to dig in, and I appreciate that feedback/motivation. (I also noticed shortly after that that I had mistakenly referred to cfmail in a couple places where I'd meant cfimap. I'd also referred to this attachment change being about SENDING attachments when instead it's about RECEIVING them. I've since corrected both mistakes.)
• The following week I added a new section on the "News of vulns being exploited".
• I've also added the new section, "How to get notified of updates by email"

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed