Read on for more, including details and observations I offer about what else has changed with this update, as well as concluding thoughts on best practices regarding any CF update.

(If I update this post since its original release, I will track those changes at the bottom of this post.)

And yes, this makes 4 CF updates in just a couple of months. I discuss those previous ones in a post about each past update.

Following are the additional topics discussed in this post:

• Updated: experience with the update since release
• My experience with the update as of the first day
• Quick overview of the update
• More on the security-related aspects of the update
• Finding the update (and more about it)
• Other matters about update (packages, connectors, bugs, known issues)
• Additional info to consider before/after doing CF updates
• On getting help with the update(s)

Updated: experience with the update since release

Update: Since I first posted this the night of the release, I have learned (from a client and from commenters below) that there IS currently a significant bug related to the update--though it affects only a very narrow audience.

This issue applies if and only if a) you are running CF Enterprise--or the free Trial or Developer editions--and have used its available Enterprise Manager feature to create instances (not available in CF Standard). Then b) if you have have created a cluster, and c) have put a CF instance into that cluster, then after applying this update any instances in the cluster will fail to function. The service will "start" (if you run it as a service), but CF within the instance will not function.

You will find in the coldfusion-error.log that among the error lines may be:

The stack trace under the error suggests that CF had a problem parsing/validating the cluster config xml within the server.xml file (which CF uses otherwise to control other aspects of the Tomcat underlying CF).

FWIW, if you were to try to start the instance from the command line (cfstart.bat or cfstart.sh), it would report that information as well.

For now, there is no known resolution. The issue has been reported in the Adobe public bug tracking system as CF-4233544. If/when I learn of any change I will update this statement...though watch the comments below as it may come up there before I get to changing this post.

The rest of the post here is as I wrote it originally, other than a couple of minor updates tracked at the bottom.

My experience with the update as of the first day

FWIW I'll note that I have installed the update for each of the releases on multiple machines, starting from different update levels, and on multiple OS's, and I can report that it went well with regard to performing the update itself.

As for whether your apps will be affected by the update, or others you may be skipping, I can't speak to that other than to offer the info about the update itself, below.

While I appreciate that some people look for my posts as a go-to resource about the update, and some may wish I'd gotten this note out earlier today, I'll note that beside testing on multiple machines, I also take time to consider feedback shared in the community, or things I may learn as I offer help to them and my own clients.

Brief overview of the update

Here's a quick summary of the key aspects of the update. I leave more details to the other resources I point to below. Briefly, this update:

• implements the latest Tomcat versions underlying each of CF2025 and CF2023: to 10.1.57 and 9.0.120.0, respectively
• introduces a breaking change (for the sake of security) which impacts on incoming websocket calls, which now default to requiring authentication, along with a jvm arg (
  -Dcoldfusion.websocket.requireAuthForInvoke
  ) AND an application-level setting to revert that changed behavior (
  this.wsRequireAuthForInvoke
  )
• introduces a new restriction on xmlsearch use of Saxon collection and uri-collection feature, to not allow calls for files or http requests, which can again be reverted with a new jvm arg,
  -Dcoldfusion.xml.saxon.allowCollection
• improves security related to the CF CCS feature (Central Configuration Server)
• improves security of the VSCode CFBuilder step debugger, another change which can be reverted by a new jvm arg,
  -Dcoldfusion.debugger.bindhost

Before I share more changes, I want to note that for more on the new jvm args (indeed, sometimes more than is discussed in the update technotes), see the available docs pages for CF2025 JVM args and CF2023/2021 JVM args.

There are a few more changes provided with this update:

• a second update is made available for the CF PMT (Performance Monitoring Toolkit). if you use that tool (which was introduced in CF2018). More on that in separate update technotes for CF2025 PMT Update 2 and CF2023 PMT Update 2
• an update to the CFBuilder VSCode extension, which "strengthens the security of the RDS Query Viewer by mitigating XSS vulnerabilities" as mentioned in a brief doc page on that latest ColdFusion Builder update
• a single bug fix, related to use of the optional CKEditor file-manager which (for the sake of security) now no longer allows uploading of html files using its upload feature, which is disabled by default
• there are 7 package updates for CF2025, and 6 for CF2023
• there are no web server connector updates in this update

More on the security-related aspects of the update

Again, this update is another one classed by Adobe as a P1 (Priority 1, "Critical") security update per the Adobe Product Security Bulletin (or APSB) for this update, which also indicates that the update addresses "vulnerabilities that could result in arbitrary code execution, privilege escalation, security feature bypass, application denial-of-service, and memory exposure". The APSB lists 15 issues, including the specific NIST CVEs addressed, having a range of CVSS scores from 4.9 to 10.0 out of 10 (with 3 scoring 9 or above).

And while it also says that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in this update", note that it's not uncommon that the vulns may immediately be being reverse-engineered and exploited by bad guys--or good guys trying to warn folks.

As such, it's always important to apply CF updates, and still more important for CF security updates, but then especially if they are classed as "critical" like this (though it's also true that some vulns are in features that may be disabled by default, or disabled for you, in which case their urgency is diminished).

Finally, as discussed in the overview above (and as happens with about 30% of CF security updates), this update has those potential breaking changes, sacrificing compatibility for security (which could affect some apps but not all). And is often teh case, there are new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.

Forewarned is forearmed.

Finding the update (and more about it)

As always, there are several ways you could find out about the update.

First, you should find news of the new update in your CF Admin upon login (assuming "check for updates" is enabled in its Package Manager "Settings" tab, or if you click the "check for updates" button under the "Core Server" section of the Package Manager page). If you don't find it there, even today, again give it time as again there may be caching issue.

(And as for getting notified by email about CF updates, see a later discussion below, How to get notified of updates by email, among the closing points about "additional info" on updates.)

Next, Adobe has announced the update via their CF Community Forums and CF Portal, specifically these:

• The Adobe CF forums announcement of the update
• Adobe Portal/blog announcement of the update

And each such Adobe announcement about an update points to the very important update technote available for each version, in this case:

• ColdFusion (2025 release) Update 12
• ColdFusion (2023 release) Update 23

BTW, note that the URL for these technotes has changed mid-year. The docs now use "guides.adobe.com" rather than the "helpx.adobe.com".

As always, the update technotes include steps for those who may need to install the update via "manual offline" steps.

And whether you may be trying to download the update via the CF admin or via download links offered in the update technote, note that sometimes issues may arise due to caching--with respect to "seeing" or downloading the update. They may be at Adobe, or at CDNs  they use, or it may be due to something in your own network. Only time will tell if it hits some, but such problems inevitably do pass.

And while there was a problem with the July 2026 CF update, where those who downloaded the package zip file found that it didn't included the actual package updates that were to be updated by this update. This problem was resolved within a few days. I can confirm that it's not a problem with the package zip files downloaded today. (There's some confusion about the checksum values offered, but I expect that will be resolved pretty quickly.)

Otherwise, as I write, there are no discussions of any issues with the updates so far. (FWIW, there tends to be more "discussion" from community members in the forum announcement than the blog post, though not always.) Note also that sometimes the community may discuss issues with the update in such places as the CFML Slack, the Facebook and Linked CF programmers group, etc. I list links to those in my cf411 site of CFML community help resources.

Additional info to consider before/after doing CF updates

Finally, just as with ANY CF update, there are a few issues you should keep in mind. Some have to do with things you should consider BEFORE doing any CF update, while others relate to considerations AFTER the update is applied.

I used to cover them within each of these posts, but I have tried to avoid repeating them. I'll say again that I plan to create a new post pulling the points out to stand alone (as like a best practices for CF updates). But until then, look first at the closing sections of my Apr 2026 update post:

• Things to beware BEFORE doing any CF update
  • Changes, as a result of any CF updates you may be skipping
  • Beware also that if you'd modified the pathfilter.json file introduced in the May 2025 CF update, sadly that file will be overwritten
• How can you assess if the update went well?
  • 1) Check the update log, both for success applying the update
  • 2) Check that same update log, for success in the update downloading any updated package
  • 3) Check the coldfusion-out.log for success during UPDATING of any packages
• A few other topics generic to recent CF updates, which you may want to consider
  • You should strongly consider "clearing the felix-cache"
  • Other update topics to consider

And then there were still other generic update topics which I'd covered in still previous posts, the last one in my post on the Oct 2024 updates. After that I started having my subsequent posts point people instead to the bottom of that post for these equally important topics:

• What to consider, with regard to some previous CF updates (possible breaking changes)
• As with all CF updates, possible need to upgrade web server connector
• Something to consider, if you're updating CF2023 from its update 4, or earlier
• and more

How to get notified of updates by email

One last generic topic, not currently covered in those two posts, is that if you may prefer getting notified by email about such CF updates, there are multiple options for that:

• Adobe offers a free service for you to be notified by email regarding any security updates. You can limit it, of course, to only CF. (It does not notify you about non-security CF updates, though.)
• In the cf admin Package Manager page, note there's a Settings tab at the top, and one of the configurable settings it to provide an email address/addresses to be notified by your own server. This assumes the CF admin Mail page is properly configured with an smtp server to deliver the email.
• Pete Freitag offers a wonderful (paid) service called HackMyCF, which despite the scary-sounding name checks regularly to let you know if you are not keeping up on CF security configuration matters, including updates and much more. (Indeed, it will warn if your cf configuration exposes the RDS feature as well as the CFIDE and cf_scripts folders which the news reports above say are being exploited if this June 30 2026 update is not applied.) Another key benefit, though, is that he also sends an email to hackmycf customers indicating when cf updates are released, usually the day they come out.
• And I, too, try to post about updates the day they come out. You can follow my rss feed or easily subscribe to get email notification of posts. See the simple form and rss feed link offered at the end of each post.
• CF hosting companies tend to share an email to their clients when updates come out, including VivioTech, xByte, and others.

On getting help with the update(s)

Finally, as for getting more help with the update, you have a few options.

First, you can reach out to Adobe via the post(s) announcing the update which I pointed to above. Adobe folks might well respond to issues you raise there. Or you could reach out to their support email addresses: [email protected] or [email protected].

Next, you can also reach out to the wider CF community for help or to hear from others. Again, I offer links to several of the online CF communities here.

Finally, if you may want help with considering, installing, or troubleshooting anything related to these updates (or indeed anything related to CF), I'm available for online remote consulting. I can often help solve such update problems VERY quickly (often minutes, rarely even hours), getting you back on your feet. More at carehart.org/consulting.

[Updates since original posting]:

• The morning after originally posting this, I decided to rearrange the information. I'm trying to balance offering detail and context against having too many words before people can see the table of contents, showing the sort of info I offer here. Of course this will become a template for future update posts.
• I also found I'd somehow lost the link to the APSB in the original post, which I corrected that next day also.
• In the days since release, a severe bug was detected, though affecting only those who a) create a CF Cluster and b) put an instance into that cluster. In that case, after this update such an instance will not properly start. For more, see the new section added near the top above, Updated: experience with the update since release.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed