Charlie Arehart - Server Troubleshooting - cf2023

Announcing ColdFusion updates of Apr 14 2026 - p1 security update - thoughts and resources

Tue, 14 Apr 2026 22:14:00 -0500

An update for ColdFusion has been released, Apr 14 2026, for each of cf2025 (as its update 7) and cf2023 (as its update 19). In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." (This is the second update since CF2021 has reached its end of life as I blogged previously, which is something folks running that should beware. You are now QUITE exposed to things fixed in these two updates, for which there is no fix for you.) In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. For more, read on. [More]

Announcing ColdFusion updates of Jan 13 2026 - p1 security update - thoughts and resources

Wed, 14 Jan 2026 00:21:00 -0500

An update for ColdFusion has been released, Jan 13 2026, for each of cf2025 (as its update 6) and cf2023 (as its update 18). (This is the first update since CF2021 has reached its end of life as I blogged previously, so this is the first cf update NOT available for cf2021, which is something folks running that should beware.) In brief, this update (for both versions) addresses a P1 (Priority 1, "Critical") security vulnerability, related to the Apache Tika java framework which Adobe embeds for certain processing with CF. Before proceeding, it's of some concern to note that unlike recent CF security updates, Adobe does NOT report (in the APSB, linked to below) that they are, "not aware of any exploits in the wild for any of the issues addressed in these updates." That omission would seem to imply that they ARE aware of this vuln being exploited, which raises the urgency of getting it applied. (It also raises the concern all the more for those on CF2021 or earlier, for whom Adobe will no longer offers ANY updates, including security updates.) In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. For more, read on. [More]

One explanation and solution for when applying CF updates uninstalls new packages unexpectedly

Wed, 10 Dec 2025 05:06:00 -0500

I offer in this post a solution to a problem that I and others experienced regarding the latest CF update (released Dec 10, 2025 for ColdFusion 2025, 2023, and 2021, which I just blogged about separately). We only experienced it with CF2023, but others have reported the problem in the past, with various CF updates to any CF version. As I'll explain it seems to be a caching problem relative to Adobe's servers (so some people may experience it, but not others):

First, you may find that after applying the update all the of the packages that were to be updated by the release will instead be UNINSTALLED unexpectedly/
Even worse, that could mean that the administrator package is uninstalled, such that you can't get to the CF Admin after the update...which will also mean you can't use the admin to try to "uninstall the update" (if you wanted to).

Of course, you could go the command line route, as you would be told to consider doing if the Administrator package was uninstalled, using CF's cfpm tool to either install the admin package or even perhaps try to uninstall the update entirely. But I have what seems to be a better solution. It's quite simple, but bear with me while I explain it...both to help you (and Adobe) better understand what seems amiss, and in case more info may come out soon from them or other folks. Beware also that if you may have "solved the problem" yourself, consider what I have to say below--you should confirm that you DO in fact have the correctly UPDATED packages, which you may have installed using that cfpm tool. [More]

Announcing ColdFusion updates of Dec 9 2025 - p1 security update and more

Wed, 10 Dec 2025 02:40:00 -0500

An update for ColdFusion has been released, Dec 9 2025, for each of cf2025 (update 5), cf2023 (update 17) and cf2021 (update 23). This is in fact that FINAL update of CF2021, as it has reached its end of life as I blogged last month. In brief, this update (for all 3 versions) addresses several P1 (Priority 1, "Critical") security vulnerabilities, and also updates Tomcat, along with updating several CF packages, and makes some other changes (see below). Note that Adobe is also reporting currently that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. Having installed the update for each of the releases on multiple machines, I can report that it went well expect for this:

Warning: beware that some folks implementing the update for CF2023 the first day (myself included) found that after applying the update, the CF Admin was inaccessible and packages that were updates were unexpectedly uninstalled. I have offered a follow-up blog post on that, One explanation and solution for when applying CF updates uninstalls new packages unexpectedly, including how to solve the problem as I see it, and how to ensure your own manual efforts to solve it are complete.

[More]

Announcing ColdFusion updates of Sep 9 2025 - p1 security update - thoughts and resources

Tue, 09 Sep 2025 23:23:00 -0500

An update for ColdFusion has been released, Sep 9 2025, for each of cf2025 (update 4), cf2023 (update 16) and cf2021 (update 22). In brief, it addresses a single P1 (Priority 1, "Critical") security vulnerabilities, along with an indicated update to the "feed" package (used by cffeed). Note that Adobe is also reporting currently that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." More below. As usual, there are a number of things you should consider before (or after) doing the update, with some discussed in Adobe's resources on the update (there are more than one), and some info that I share below based on my experience helping people apply this and past updates. In this post, I share the details about the update (from Adobe and from others). I can report I have installed the update for each release on multiple machines and operating systems without any major incidents. As for challenges (common to recent releases) and lessons learned (about this update), read on. [More]

Announcing ColdFusion updates of July 8 2025 - p1 security update and more

Wed, 09 Jul 2025 23:45:00 -0500

An update for ColdFusion has been released, July 8 2025, for each of cf2025 (update 3), cf2023 (update 15) and cf2021 (update 21). In brief, it addresses a number of P1 (Priority 1, "Critical") security vulnerabilities and more, including bug fixes and some modest feature changes. As usual, there are a number of things you should consider before (or after) doing the update, with some discussed in Adobe's resources on the update (more than one), and some that I share below based on my experience helping people apply this and past updates. Finally, the update corrects some issues introduced in the previous updates, released in May. In this post, I share the details about the update (from Adobe and from others). I can report I have installed the update for each release on multiple machines and operating systems without any major incidents. As for challenges (common to recent releases) and lessons learned (about this update), read on. [More]

Announcing ColdFusion updates of May 13 2025 - p1 security update - thoughts and resources

Wed, 14 May 2025 03:10:00 -0500

An update for ColdFusion has been released, May 13, 2025, for both cf2025 (update 2), cf2023 (update 14) and cf2021 (update 20). In brief, it addresses a P1 (Priority 1, "Critical") security vulnerability, as indicated in the associated ASPB (security bulletin) for the update. The update also incorporates potentially breaking changes (with Adobe trading compatibility for security), while it also includes configurable options to undo those changes (if you prefer to trade away security for compatibility). Finally, the update corrects some issues introduced in the previous updates, released in April. In this post, I share the details about the update (from Adobe and from others). I can report I have installed both updates on multiple machines and operating systems without incident. As for challenges or lessons learned, I may do a follow-up post as I/we all learn more. For more details, read on. [More]

Delighted to be speaking at Into the Box 2025, in early May

Mon, 17 Mar 2025 10:50:00 -0500

I'm delighted to announce that I've been selected to speak at the upcoming Into the Box event (in DC in early May), where I'll be presenting "Hidden Gems in FusionReactor: for BoxLang, ACF, and Lucee Users". This should not be confused of course with the "Hidden Gems in CF2025" talk which I also just announced that I'd be presenting at the upcoming CF Summit East (next week in DC) and CFCamp (in Munich in late May). It'll be a busy few weeks! :-) As with them, it's always a thrill to attend this annual event. Following is the topic description and more. [More]

A table of Java versions supported by given ColdFusion versions

Thu, 13 Mar 2025 23:57:00 -0500

Now that CF2025 has come out, supporting Java 21--and as ColdFusion and Java versions continue to evolve--you may wonder which version(s) of Java you can use with your current (or a given) version of ColdFusion. You can't just use "any" jvm version with CF: it depends on first on what version of CF you are using, and then may even depend on what CF update has been applied to that CF version. (You also can't use Java from any vendor: Adobe supports only use of Oracle Java, and they license it for our use, as I discuss later.) And to be clear, currently ONLY CF2025 supports Java 21. (And with Java 24 coming out in Mar 2025 as the latest LTS or "long-term support" Java releases, note that NO CF version currently supports that.) So in this post, I offer a table that clarifies things, listing the various recent CF versions (even those no longer supported) and what (LTS) Java versions they supported, including if some CF update of a version changes the Java version supported. [More]

ColdFusion 2025 released, Feb 25 2025 - resources and my initial thoughts

Tue, 25 Feb 2025 19:55:00 -0500

ColdFusion 2025 has been released today, Feb 25 2025. In this post I am not only helping share news of the release, and pointing to available resources, but I also share some thoughts/observations on related matters that may be a bit challenging for most to find more about on their own (if they may only assess a couple of resources, or hear only tidbits shared in social media). First, for more on the many features and changes, I share many Adobe resources--about which I also offer some additional comment. I also discuss changes regarding OS and DB support as well as the fact that CF2025 now runs on Java 21-- and that the traditional server deployment of CF comes installed atop Tomcat 10.1. I then share still more info on other matters and resources related to the new version. I then focus on the major change in licensing, for CF2025 and forward, to being subscription only--which I'll note has no effect on those currently running CF2023 or earlier. I share pricing info and also help in assessing differences in the EULA, and more. Finally I discuss some migration considerations--including important REMOVAL of some older features from CF2025, as CF continues to be made more secure and modernized. I also identify tools and resources to help aid you in that migration, when you're ready to begin attempting it. For all that and more, read on. [More]

Last chance to save 25% off CF2023, for those on CF2018 and earlier

Fri, 17 Jan 2025 15:30:00 -0500

Here's great news for those still running CF2018 or earlier, who may have been holding off upgrading to CF2023 (because you would have to pay full price for it). It's news I first shared back in July, and the deal has been extended one last time, thus this post. TLDR; Now through Feb 28, 2025 those running CF9, 10, 11, 2016 or 2018 can upgrade to CF2023 for 25% off its full price. (Those running CF2021 can already/always could upgrade at 50% off the full price.) This is a deal offered only by Intergral, makers of FusionReactor, who are also resellers of CF. Adobe doesn't even offer this deal themselves. For more, see their blog post at https://fusion-reactor.com/blog/news/save-25-on-adobe-cf2023-upgrades/. Act now, it could save you hundreds or even thousands of $$s on a single license! For more, read on. [More]

Beware that ColdFusion 2021 end-of-life (and end of updates) is coming Nov 2025, and your options

Thu, 09 Jan 2025 16:59:00 -0500

Are you still running ColdFusion 2021? While it's still supported/updated by Adobe, did you know that its end of life is coming just several months from now, Nov 10, 2025? That's the date when "core" support for that release ends--meaning no more updates from Adobe after that, not even security fixes. What about more recent releases, if you may wonder? CF 2023 (the current latest release) will get updates into 2028 (5 years after it was release). And there's the coming CF 2025 release, currently in pre-release (as I have recently blogged about), which is of course a great sign for the continued vitality of CF. But this looming deadline for CF2021 is a reminder that as the years roll on, we not only get new versions but we must say good-bye to old ones. Wondering what you can do? or when CF2023 or CF2025 support will end also? And what's the difference between "core" support and the available "extended" support which Adobe sells? (The extended support plan does NOT provide updates beyond this coming November.) For more on these, including official Adobe documentation that discusses such things, as well as my thoughts on migration, costs, various options to consider, and more, do read on. [More]

Announcing ColdFusion updates of Dec 23 2024 - p1 security update

Mon, 23 Dec 2024 23:56:00 -0500

An update for ColdFusion has been released today for both cf2023 (update 12) and cf2021 (update 18). In brief, it addresses a P1 (Priority 1, "Critical") security vulnerability, as indicated in the associated ASPB (security bulletin) for the update (CVSS Base Score of 7.4 out of 10). In this post, I share the details about the update (from Adobe and from others, including pointing to some discussions I've already started online about the update). Note also that while you may read that the update is related to the CF PMT feature, beware presuming it therefore "doesn't apply to you" because you "don't use it". See the next section for more. Of course, this is terrible timing for an update, but it is what it is. I can report I have installed both updates on multiple machines and operating systems without incident. And I may do a follow-up post on the update as I/we all learn more. For more details, read on. [More]

Announcing ColdFusion updates of Oct 15 2024 - enhancements and fixes

Wed, 16 Oct 2024 01:02:00 -0500

An update for ColdFusion has been released yesterday for both cf2023 (as update 11) and cf2021 (as update 17). In brief, the update has no security fixes, but it does fix dozens of issues that folks have stumbled over recently. It also upgrades some "OEM" libraries underlying CF, and it offers some modest enhancements. Also, if you may be skipping to this update from prior to CF2023 update 7 or earlier, or CF2021 update 13 or earlier, please don't apply the update before reading below my discussion about possible breaking changes introduced in those updates from March and June of this year. For more details, read on. [More]

Announcing ColdFusion updates of Sep 10 2024 - P3 security update

Fri, 13 Sep 2024 17:48:00 -0500

Though the news is a couple of days old, I want to share with my readers that an update for ColdFusion has been released Tuesday, Sep 10, for both cf2023 (update 10) and cf2021 (update 16). In brief, the "only" change is to address a security vulnerability, which is listed in the associated ASPB (security bulletin) for the update as a "critical" severity (CVSS Base Score of 9.8 out of 10)...though curiously that also lists it as being merely a "moderate" priority (3 out of 3). Also, if you may be skipping to this update from prior to CF2023 update 7 or earlier, or CF2021 update 13 or earlier, please don't apply the update before reading below my discussion about possible breaking changes in those updates from March and June of this year. And there's still more to consider. Note that if somehow "it's all too much" for you, I can help directly and likely VERY quickly. See my discussion at the bottom here. Otherwise, for the details, read on. [More]