Whatever message this page gives is out now! Go check it out!
ColdFusion (2023 release) Update 25
Last update:
Sep 23, 2026
Explore the OEM upgrades, Query-of-Queries enhancements, query metadata improvements, spread operator fixes, and other updates in ColdFusion (2023 release) Update 25.
Security recommendations
For all security updates, Adobe recommends applying the security configuration settings outlined on the ColdFusion Security page and reviewing the respective Lockdown guide.
Note:
The updates below are cumulative and contain all updates from previous ones. If you are skipping updates, you can apply the latest update, not those you are skipping. Further, you must take note of any changes that are implemented in each of the updates you are skipping.
View ColdFusion (2023 release) Updates for more information.
What's new and changed
ColdFusion (2023 release) Update 25 (release date: September 23, 2026) includes extensive OEM library upgrades, enhancements to Query-of-Queries, query metadata handling, and the spread operator, along with fixes across ColdFusion Administrator, SFTP, Solr, MongoDB, SendGrid, scheduled tasks, GraphQL, Redis configuration, and other core and package functionality.
OEM upgrades
The following table lists all OEM upgrades in this update:
| Jar / File | Previous version | New version | Location |
| accessors-smart | 2.5.1 | 2.6.0 | <root>/bundles/repo/ |
| apache-maven | 3.8.6 | 3.9.16 | <root>/cfusion/maven/apache-maven-3.9.16/ |
| avro | 1.7.7 | 1.11.5 | <root>/cfusion/lib/ |
| ckeditor.js | 4.22.1 | 4.22.1-acf | <root>/cfusion/wwwroot/cf_scripts/scripts/ajax/ckeditor/ |
| commons-beanutils | 1.9.3 | 1.11.0 | <root>/cfusion/lib/ |
| commons-compress | 1.19 | 1.26.2 | <root>/cfusion/lib/ + <root>/bundles/repo/ |
| commons-fileupload | 1.3.3 / 1.4 / 1.5 | 1.6.0 | <root>/cfusion/lib/bundleaxis/ + <root>/bundles/repo/ |
| commons-net | 3.6 | 3.10.0 | <root>/cfusion/lib/ |
| commons-vfs2 | 2.6.0 | 2.10.0 | <root>/cfusion/lib/ |
| cxf-core | 4.0.5 | 4.1.7 | <root>/cfusion/lib/cxf-core.jar (unversioned name) |
| cxf-rt-frontend-jaxrs | 4.0.5 | 4.1.7 | <root>/cfusion/lib/cxf-rt-frontend-jaxrs.jar |
| cxf-rt-rs-client | 4.0.5 | 4.1.7 | <root>/cfusion/lib/cxf-rt-rs-client.jar |
| guava | 31.1-jre (also 20.0 legacy) | 33.5.0-jre | <root>/bundles/repo/ |
| jansi | 1.18 | 2.4.2 | <root>/cfusion/lib/ |
| jetty-http | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-io | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-security | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-server | 9.4.39/9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ (9.4.58) |
| jetty-servlet | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-servlets | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ |
| jetty-util | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-util-ajax | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jetty-xml | 9.4.51 | 9.4.58.v20250814 | <root>/cfusion/jetty/lib/ + <root>/bundles/repo/ |
| jquery | 2.2.1 | 3.7.1 | <root>/cfusion/wwwroot/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/ |
| jquery-ui | 1.10.3 | 1.13.2 | <root>/cfusion/wwwroot/cf_scripts/scripts/ajax/jquery/ |
| json-smart | 2.5.1 (also 2.3 legacy) | 2.6.0 | <root>/bundles/repo/ |
| log4j-api | 2.17.2 | 2.25.4 | <root>/cfusion/lib/ + <root>/cfusion/jetty/lib/ext/ |
| log4j-core | 2.17.2 (also 2.20/2.21/2.24) | 2.25.4 | <root>/cfusion/lib/ + <root>/cfusion/jetty/lib/ext/ |
| netty-codec-base | — (new) | 4.2.7.Final | <root>/bundles/repo/ |
| netty-codec-http2 | 4.1.113.Final | 4.2.7.Final | <root>/bundles/repo/ |
| netty-common | 4.1.113.Final | 4.2.7.Final | <root>/bundles/repo/ |
| netty-handler | 4.1.113.Final | 4.2.7.Final | <root>/bundles/repo/ |
| nimbus-jose-jwt | 9.37.3 (also 8.2 legacy) | 9.37.4 | <root>/bundles/repo/ |
| pebble.jar | (present) | removed | <root>/cfusion/lib/pebble.jar |
| sanselan | 0.97 | removed → commons-imaging 1.0-alpha2 | old: was <root>/cfusion/lib/; new commons-imaging → <root>/bundles/repo/ |
| tika-core | 1.2 | 2.9.4 | <root>/cfusion/lib/ |
| tika-parsers | 1.2 | standard-package-2.9.4 | <root>/cfusion/lib/ |
| xercesImpl | 2.10.0 | 2.12.2 | <root>/cfusion/lib/ |
Bugs fixed in the update
| Bug ID | Description | Component |
|---|---|---|
| CF-4226391 | Changing the default scripts directory could break AJAX package handling. This caused startup-time errors and package installation issues in hardened or lockdown-style deployments that used a custom scripts path. | AJAX |
| CF-4225202 | The Maintain connection to mail server option in ColdFusion Administrator could appear to save successfully even though the setting did not persist | Administrator |
| CF-4224932 | The ColdFusion Administrator log viewer could truncate multiline log messages and hide the most important part of an error. | Administrator |
| CF-4221716 | The Administrator update page could misleadingly show the currently installed core update inside the Available Versions dropdown. | Administrator |
| CF-4225873 | Settings Summary in the ColdFusion Administrator could error out on J2EE deployments after recent updates. This affected JBoss EAP deployments and disrupted expected Administrator reporting behavior. | Administrator : Administrator Console |
| CF-4227359 | Administrator users authenticated through AD/LDAP groups could log in but still lose access to parts of the Administrator. Some menus triggered errors or unexpected logouts, making group-based admin access unreliable after the update. | Administrator : UserManager - LDAP |
| CF-4226870 | ColdFusion treated valid SendGrid API keys as invalid encoded input, preventing successful mail configuration and delivery. | ColdFusion Package : Mail |
| CF-4227376 | Remote function calls broke when applications decrypted or rewrote query-string parameters during request processing. This caused required arguments to appear missing even though applications were populating them before the remote method was expected to run. | Core Runtime |
| CF-4227568 | Per-application MySQL datasource setup incorrectly depended on the GraphQL Client package. A datasource configuration flow that should have worked independently failed unless an unrelated package was installed. | Core Runtime : Application |
| CF-4224862 | Query of Queries could mis-handle datatypes after sorting, causing newly added varchar columns to be treated as integers. When a query had been sorted with fully qualified column names, later calls such as QueryAddColumn or querySetCell could fail with DataTypeMismatchException instead of accepting string values. | Database : CFQuery |
| CF-4225888 | MongoDB autogenerated _id ObjectIds were not handled correctly across key operations. | Database : NoSQL (MongoDB) |
| CF-4229926 | Query of Queries handled null values inconsistently for varchar columns. Conditions such as IS NULL and IS NOT NULL did not correctly match null string values, creating different behavior from integer columns and from prior ColdFusion versions. | Database : Query-of-Query (IMQ) |
| CF-3806744 | Query of Queries could change nvarchar columns to varchar in the returned recordset. This caused later cfqueryparam comparisons using cf_sql_datatype="nvarchar" to fail instead of working with the original datatype. | Database |
| CF-4226604 | ActiveMQ Event Gateway instances failed to start with missing JMS-related class errors. | Event Gateway |
| CF-4226965 | Static variables did not work correctly in tag-based cfcomponent definitions. Code that should have allowed static member access in tag-based components either failed outright or behaved inconsistently compared with script-based components. | Language : CF Component |
| CF-4219724 | In ColdFusion 2023, using the spread operator with an indirectly referenced or nested struct could produce incorrect results. Instead of expanding the referenced struct’s keys into the destination struct, ColdFusion could add the parent variable name as a key. | Language : Spread Operator |
| CF-4226969 | querySlice() dropped the original column type metadata from sliced query results. This caused problems in downstream use cases that depended on datatype preservation, including serialization and metadata-aware processing. | Language : Query Functions |
| CF-4225089 | SFTP connections could fail during cipher negotiation when connecting to servers that only supported older cipher suites. | Net Protocols : FTP |
| CF-4225082 | SFTP connections could stop working after ColdFusion updates when target servers depended on older host key, key exchange, or SHA-1 based algorithms. Use the following JVM flags only when the remote SFTP server requires the corresponding legacy algorithms: -Dcoldfusion.sftp.enable-ssh-rsa and -Dcoldfusion.sftp.enable-sha1-algorithms. | Net Protocols : FTP |
| CF-4221426 | Applying updates from ColdFusion Administrator could stall when Preserve case of structure keys for serialization was enabled. The UI could remain stuck at Starting Download... or fail to progress correctly. | Packages : Update Workflow |
| CF-4225450 | Fixed an issue in ColdFusion Administrator that prevented administrators from reloading or indexing ColdFusion Solr collections after enabling Basic Authentication for the bundled Solr server. Previously, an index or reload operation could fail with an error similar to: Element LANGUAGE is undefined in GETCOLLECTIONINFOThis issue prevented collection administration even when the configured Solr Basic Authentication credentials were valid. | Packages : Search |
| CF-4223789 | Scheduler task errors could be swallowed when an application defined Application.cfc onError(). In that scenario, task-level onError handlers were not invoked correctly, application-level error handling became inconsistent, and failures could disappear without reaching expected logs. | Scheduler |
| CF-4206491 | Scheduled tasks using Daily, Weekly, or cron intervals could run successfully without updating the Last Run value in ColdFusion Administrator. This made task execution history appear incorrect in the Administrator UI. | Scheduler |
| CF-4225567 | Solr basic authentication could break collection access in the ColdFusion Administrator and cause cfsearch and cfindex operations to fail. After enabling Solr Basic Auth, collections could disappear, collection detail pages could throw errors such as Element LANGUAGE is undefined in GETCOLLECTIONINFO, and search/index operations could incorrectly report that existing collections did not exist. | Text Search : Solr |
Prerequisites
- On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
- If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
- http.proxyHost
- http.proxyPort
- http.proxyUser
- http.proxyPassword
- For ColdFusion running on JEE application servers, stop all application server instances before installing the update.
ColdFusion JDK flag requirements
ColdFusion 2023 (version 2023.0.0.330468) and above
For Application Servers
On JEE installations, set the following JVM flag, " -Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**; !com.mysql.cj.jdbc.interceptors.**;!org.apache.commons.collections.**;", in the respective startup file depending on the type of Application Server being used.
On JEE installations, set the following JVM flag, " -Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**; !com.mysql.cj.jdbc.interceptors.**;!org.apache.commons.collections.**;", in the respective startup file depending on the type of Application Server being used.
For example:
- Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
- WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
- WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone installation.
Installation
ColdFusion Administrator
In Package Manager > Packages, click Check for Updates in Core Server.
After it detects an update, click Update. The core package gets updated the the latest update.
All installed packages also get updated.
Restart ColdFusion for the changes to take effect.
Install the update in offline mode manually
- Download the hotfix installer from the link. (MD5: 123853a4960fd9baf65c3c7c2325ec45 )
- Download the packages zip (MD5: c109e1c1058d7c06f6729422b99f252b) file from this link and extract its contents to a location accessible to all ColdFusion server instances.
- Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.
You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.
- Windows: <cf_root>\jre\bin\java.exe -jar <InstallerRepositoryUnzippedPath>\bundles\updateinstallers\hotfix-025-330977.jar
- Linux-based platforms: <cf_root>/jre/bin/java -jar <InstallerRepositoryUnzippedPath>/bundles/updateinstallers/hotfix-025-330977.jar
If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).
Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.
Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers.
For further details on manually updating the application, see the help article.
Note:
If you are on Java 17.0.8 or higher and want to apply the Hotfix manually, use the flag java -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar hotfix.jar.
However, if you are applying the update from the Administrator, you do not require any flag.
Post installation
Note:
After applying this update, the ColdFusion build number should be 2023,0,25,330977
Uninstallation
To uninstall the update, perform one of the following:
- In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
- Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2023-00025-330977/uninstall /uninstaller.jar
If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:
- Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
- Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2023-00025-330977}/backup directory to {cf_install_home}/{instance_name}/
Note:
Uninstalling this update only removes the core update itself. Any ColdFusion packages that were updated as part of this release remain at their latest compatible versions. If you need to revert package versions, you must do so separately; uninstalling the core update does not roll back package versions automatically.
Q: If I uninstall ColdFusion 2023 Update 25, will all the packages installed with it be rolled back?
A: No. Package rollback depends on the minimum core dependency of each package:
A: No. Package rollback depends on the minimum core dependency of each package:
- Packages with a minimum core dependency of update 25 (that is, they specifically require this core level) are rolled back when you uninstall this core update.
- Packages with a minimum core dependency of update 24 or update 23 remain installed at their latest compatible versions and are not rolled back automatically when you uninstall the core update.
Connector configuration
| 2023 Update | Connector recreation required |
| Update 25 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 24 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 23 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 22 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 21 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 20 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 19 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 18 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 17 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 16 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 15 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 14 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 13 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 12 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 11 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 10 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 9 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 8 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 7 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 6 | No However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors: |
| Update 5 | Yes |
| Update 4 | No |
| Update 3 | No |
| Update 2 | No |
| Update 1 | No |
Package updates
| Update | Packages updated |
| Update 25 | Yes
|
| Update 24 | Yes |
| Update 23 | Yes
|
| Update 22 | Yes
|
| Update 21 | Yes
|
| Update 20 | Yes
|
| Update 19 | Yes
|
| Update 18 | Yes
|
| Update 17 | Yes
|
| Update 16 | Yes
|
| Update 15 | Yes The following packages are updated:
|
| Update 14 | Yes The following packages are updated:
|
| Update 13 | Yes The following packages are updated:
|
| Update 12 | Yes The pmtagent package is updated. |
| Update 11 | Yes |
| Update 10 | No |
| Update 9 | No |
| Update 8 | Yes |
| Update 7 | Yes |
| Update 6 | No |
| Update 5 | Yes |
| Update 4 | No |
| Update 3 | No |
| Update 2 | No |
| Update 1 | No |
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Share additional feedback to help us improve.
0/255
|
