[Looking for Charlie's main web site? or all posts?]

Announcing ColdFusion updates of Sep 8 2026 - p1 security update

Adobe has released another set of updates today, Sept 8 2026, for CF2025 (update 13) and CF2023 (update 24). As with other recent updates, these "resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure."

Rather than detail the updates as I have in the past, I will for now leave this at simply announcing the update and pointing you to Adobe's several resources with more on the updates. The first 3 are community resources where other folks may (over time) share feedback or observations about the update(s), which point to the last 2 (the update technotes) and more:

Each of the resources link to still more info about the CF updates in general and about this most recent one in particular, including downloads for the update jar file and packages zip file (for those who may need those for command-line or offline updates) as well as the APSB offering security vuln details.

As has been the case in recent updates, note that the update technotes indicate some changes arising from the new security protections as well as available mitigation options.

We must balance the urgency of the update (for the security protections) against the potential changes in compatibility, along with the available mitigations (which would re-open a door that Adobe is closing in this update). Sadly, there's never enough detail in the information provided to assess that on this first day. Time will tell.

Experience so far...

FWIW I have not seen any discussions of update issues today in the community resources above.

If I learn of any significant ramifications of this update, I may offer comments below, or an update to this post, or potentially even a new post.

I can say that I have applied the update on both versions, on multiple machines and different OS's, without any trouble during the update. I've also confirmed that the downloadable zip of packages offers the updated packages indicated in each update technote (there have been recent occasions where the zip did NOT include the updated packages).

Getting help, from me or others

As always, if you have need of assistance in applying or dealing with the ramifications of the update, note first that you can use those community resources above to seek help publicly.

Or I am available for remote screenshare consulting. I can usually solve most update-related problems very quickly, since I help so many people with them in each update (whether publicly or directly). See carehart.org/consulting for more on my rates, approach, satisfaction guarantee, online calendar, and more.


For more content like this from Charlie Arehart: Need more help with problems?
  • If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
  • See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
Comments
Copyright ©2026 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the HTML in this page?)

Managed Hosting Services provided by
xByte cloud Hosting