Whatever message this page gives is out now! Go check it out!

ColdFusion (2023 release) updates

Last update:
May 18, 2026
ColdFusion (2023 release) updates
This article lists all released ColdFusion (2023 release) updates.
Note:
Adobe recommends always applying the latest ColdFusion (2023 release) update.

COLDFUSION (2023 RELEASE) UPDATE 19

ColdFusion (2023) Update 19 (release date: 14 April, 2026) includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, application denial-of-service, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.116.0.
View the security bulletin, APSB26-38, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 19 (MD5: e3915aee7452b53e4482b49cdf5f9eb1)
Hotfix and packages repository: Link (MD5: abadf165020f83b3c96701b3057c481f)
Build Number: 2023,0,19,330899

COLDFUSION (2023 RELEASE) UPDATE 18

ColdFusion (2023 release) Update 18 (release date: 13 January, 2026) addresses CVE-2025-66516, a critical XXE in Apache Tika libraries. Adobe strongly recommends that you apply this update as soon as possible. Note that this update is cumulative and includes fixes from previous updates. 
ColdFusion (2023 release) Update 18 includes Apache Tika version 2.9.4, which is the latest supported version for this release. Due to compatibility and compliance requirements, Apache Tika 3.x is not included in ColdFusion 2023.
To address CVE-2025-66516, Adobe has backported the required security fixes into the Apache Tika 2.9.4 version shipped with ColdFusion 2023 Update 18. As a result, ColdFusion 2023 Update 18 is protected against CVE-2025-66516, even though the Apache Tika version number is lower than 3.x.
Some vulnerability scanners may continue to report this CVE based solely on the Apache Tika version string.
View the security bulletin, APSB26-12, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 18 (MD5: 87c9cbacd1ea6694865674b114918abb)
Hotfix and packages repository: Link (MD5: 8dd96678485def13893fd5ef90c16245)
Build Number: 2023,0,18,330879

COLDFUSION (2023 RELEASE) UPDATE 17

ColdFusion (2023 release) Update 17 (release date, 9 December 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.111.0.
View the security bulletin, APSB25-105, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 17 (MD5: 09de89142ef3a4311391a53419489bcc)
Hotfix and packages repository: Link (MD5: effda3dda03c5175d272cbc9c67dcd44)
Build Number: 2023,0,17,330864

COLDFUSION (2023 RELEASE) UPDATE 16

ColdFusion (2023 release) Update 16 (release date, 9 September, 2025) addresses an important security fix related to critical path traversal.
View the security bulletin, APSB25-93, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 16 (MD5: 54813fbeefa2c5990fbac4cd89ed9639)
Hotfix and packages repository: Link (MD5: eaf7227495a12d7cc0b3605030d6c6c6)
Build Number: 2023,0,16,330828

COLDFUSION (2023 RELEASE) UPDATE 15

ColdFusion (2023 release) Update 15 (release date, July 8, 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass.
The update also upgrades the underlying Tomcat engine to version 9.0.106 and resolves several issues reported in earlier updates.
View the security bulletin, APSB25-69, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 15 (MD5: 145da616a376ae41357340da07bd3d7c)
Hotfix and packages repository: Link (MD5: ab2ab6a30ec3ac5ebfeb3faac8aeca29)
Build Number: 2023,0,15,330825

COLDFUSION (2023 RELEASE) UPDATE 14

ColdFusion (2023 release) Update 14 (release date, May 13, 2025) resolves critical and important vulnerabilities that could lead to arbitrary file system reads, arbitrary code execution, privilege escalation, and security feature bypass. It also addresses the PDFg service-related issues from the previous ColdFusion updates.
View the security bulletin, APSB25-52, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 14 (MD5: f4f278280daa20fe635144dc1deb7ea5)
Hotfix and packages repository: Link (MD5: 2c199240ceca69096b68794d8f683fab)
Build Number: 2023,0,14,330784

COLDFUSION (2023 RELEASE) UPDATE 13

ColdFusion (2023 release) Update 13 (release date, April 08, 2025) resolves several critical vulnerabilities that could lead to arbitrary file system reading, arbitrary code execution, and security feature bypass.
View the security bulletin, APSB25-15, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 13 (MD5: b9b3690c7829693325dba0ba037649db)
Hotfix and packages repository: Link (MD5: 1801670c3804fec22edc2d3acb05d372)
Build Number: 2023,0,13,330759

COLDFUSION (2023 RELEASE) UPDATE 12

ColdFusion (2023 release) Update 12 (release date, December 23, 2024) resolves a critical vulnerability that could lead to arbitrary file system read.
View the security bulletin, APSB24-107, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 12 (MD5: cab3018d9c64cdf578bdf2de28746889)
Hotfix and packages repository: Link (MD5: f766e21b0152afce46923be9da730c90)
Build Number: 2023,0,12,330713

COLDFUSION (2023 RELEASE) UPDATE 11

ColdFusion (2023 release) Update 11 (release date, October 15, 2024)  includes bug fixes and enhancements in Administrator, Language, CFSetup, Database, and other areas. The update also contains library upgrades, such as Jackson-data-bind, netty, ehcache, etc.
For more details, see this article.
Type: General
File: ColdFusion (2023 release) Update 11 (MD5: 43cb92b3eb072f68cf55e6c8994de0e2)
Hotfix and packages repository: Link (MD5: 2b4c02eb54d4e241f582b3349dfbfd5e)
Build Number: 2023,0,11,330706

COLDFUSION (2023 RELEASE) UPDATE 10

ColdFusion (2023 release) Update 10 (release date, September 10, 2024) resolves a critical vulnerability that could lead to the deserialization of untrusted data. View the security bulletin, APSB24-71, for more information.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 10 (MD5: 4482a8591ac41012864a21cab8019561)
Hotfix and packages repository: Link (MD5:a1823b038e68ff9221a351c6a7c17779)
Build Number: 2023,0,10,330680

COLDFUSION (2023 RELEASE) UPDATE 9

In ColdFusion (2023 release) Update 9 (release date, August 20, 2024), we’ve upgraded Tomcat from version 9.0.85 to version 9.0.93.
For more details, see this article.
Type: General
File: ColdFusion (2023 release) Update 9 (MD5: 4c2ab5341cea786aabfe1716db2c262f)
Hotfix and packages repository: Link (MD5: 90881a521fd0e6f3ddd25b38ac12d2a2)
Build Number: 2023,0,9,330677

COLDFUSION (2023 RELEASE) UPDATE 8

ColdFusion (2023 release) Update 8 (release date, June 11, 2024) addresses vulnerabilities mentioned in the security bulletin, APSB24-41.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 8 (MD5: eb83e37a682f02ad9ba8e4cfddb32b13)
Hotfix and packages repository: Link (MD5: 1b2c8711197f932a994b5280492ccb7d)
Build Number: 2023,0,8,330668

COLDFUSION (2023 RELEASE) UPDATE 7

ColdFusion (2023 release) Update 7 (release date, 12 March, 2024) addresses vulnerabilities mentioned in the security bulletin, APSB24-14.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 7 (MD5: 2b0f5588a81851f1e7bf874dd60bae8e)
Hotfix and packages repository: Link (MD5: 0a643cc62929976f6cc880ed2c3ccbf5)
Build Number: 2023,0,7,330663

COLDFUSION (2023 RELEASE) UPDATE 6

ColdFusion (2023 release) Update 6 (release date, 14 November, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-52.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 6 (MD5: 1d7a8944c790da9d093a8ec81a8c7156)
Hotfix and packages repository: Link (MD5: ce94dbe4b7477e011dc01d825570dba8)
Build Number: 2023,0,6,330617

COLDFUSION (2023 RELEASE) UPDATE 5

ColdFusion (2023 release) Update 5 (release date: October 5, 2023) includes bug fixes and enhancements in Administrator, Installer, Migration, Package manager, Database, and other areas. The update contains upgrades to Tomcat (v9.0.78) and other libraries, such as jackson-databind, Netty, etc. Note that this update is cumulative and includes fixes from the previous updates.
For more details, see this article.
Type: General
File: ColdFusion (2023 release) Update 5 (MD5: 149975e2324eda2c9fb4c17506ba0fc6)
Hotfix and packages repository: Link (MD5: 45faef8b991db1925265cfcf410d9f20)
Build Number: 2023,0,5,330608

COLDFUSION (2023 RELEASE) UPDATE 4

ColdFusion (2023 release) Update 4 (release date, 17 August, 2023) introduces the ColdFusion serial filter that can be used to allow or disallow Java classes or packages for the deserialization of Wddx packets.
For more details, see this article.
Type: General
File: ColdFusion (2023 release) Update 4 (MD5: d32b2d16ed4b5d8689f1db234d924318)
Hotfix and packages repository: Link (MD5: c89329ab072cf3f5a513dd6fc91ab2b1)
Build Number: 2023,0,4,330500

COLDFUSION (2023 RELEASE) UPDATE 3

ColdFusion (2023 release) Update 3 (release date, 19 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-47.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 3 (MD5: 723c3351b4921db90adf66cd8056df45)
Hotfix and packages repository: Link (MD5: dd87c0ca90d049834b1ab450a994eb6a)
Build Number: 2023,0,3,330486

COLDFUSION (2023 RELEASE) UPDATE 2

ColdFusion (2023 release) Update 2 (release date, 14 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-41.
For more details, see this article.
Type: Security
File: ColdFusion (2023 release) Update 2 (MD5: 078a2e6b63f4ee0cca3c4aabfdf3666c)
Build Number: 2023,0,2,330482

COLDFUSION (2023 RELEASE) UPDATE 1

ColdFusion (2023 release) Update 1 (release date, 11 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-40.
For more details, see this article.
Type: General
File: ColdFusion (2023 release) Update 1 (MD5: 8e631f96ead408740a46b0f5c66706be)
Build Number: 2023,0,1,330480

Share this page

Was this page helpful?
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Thank you for your feedback. Your response will help improve this page.

On this page