Whatever message this page gives is out now! Go check it out!

ColdFusion (2023 release) Update 26

Last update:
Oct 13, 2026
ColdFusion (2023 release) Update 26 tech notes, containing bug fixes, enhancements, and security guidelines.

Security recommendations

For all security updates, Adobe recommends applying the security configuration settings outlined on the ColdFusion Security page and reviewing the respective Lockdown guide.
Note:
The updates below are cumulative and contain all updates from previous ones. If you are skipping updates, you can apply the latest update, not those you are skipping. Further, you must take note of any changes that are implemented in each of the updates you are skipping.
View ColdFusion (2023 release) Updates for more information.

What's new and changed

ColdFusion (2023 rserelease) Update 26 (release date: October 13, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.
View the security bulletin, APSB26-144, for more information.
Tomcat upgrade
This security update includes an upgrade to Tomcat v9.0.122.
New JVM flags
ColdFusion security JVM flags
JVM flagDescriptionDefault value
-Dcoldfusion.websocket.requireAuthForInvokeSpecifies whether authentication is required when invoking ColdFusion components through WebSocket connections. When enabled, unauthenticated WebSocket clients cannot invoke component methods. The per-application setting this.wsRequireAuthForInvoke in Application.cfc also controls this behavior.true
-Dcoldfusion.security.ssrf.disableProtectionSpecifies whether ColdFusion's Server-Side Request Forgery (SSRF) protection is disabled. Set this flag to true to disable SSRF protection.false
-Dcoldfusion.saferegex.maxpatternlenSpecifies the maximum allowed length of a regular expression pattern processed by the SafeRegex implementation.1000
-Dcoldfusion.saferegex.maxsubjectlenSpecifies the maximum length of the input string that can be processed by the SafeRegex implementation.100000
-Dcoldfusion.saferegex.matchtimeoutmsSpecifies, in milliseconds, the maximum amount of time allowed for a SafeRegex match operation.250
-Dcoldfusion.saferegex.stringfunc.patterncachesizeSpecifies the maximum number of compiled regular expression patterns cached for ColdFusion string functions.2000
-Dcoldfusion.sql.allowUnsafeStoredProcIdentifiersSpecifies whether potentially unsafe identifiers are permitted when invoking stored procedures. Set this flag to true to allow unsafe stored procedure identifiers.false
-Dcoldfusion.xml.wstxMaxEntityCountSpecifies the maximum number of XML entities that the Woodstox XML parser can process while parsing an XML document.100000
-Dcoldfusion.xml.wstxMaxEntityDepthSpecifies the maximum nesting depth of XML entities that the Woodstox XML parser can process.500
-Dcoldfusion.cppcfx.disableLibraryPathValidationSpecifies whether library path validation for C++ CFX tags is disabled. Set this flag to true to disable library path validation.false
-Dcoldfusion.rds.security.disableFileProtectionSpecifies whether file protection for ColdFusion Remote Development Services (RDS) is disabled. When set to true, RDS file protection is disabled, allowing RDS file operations without the file protection restrictions.false
View JVM flags in ColdFusion 2023 for more information.

Security changes that require action

Update 26 includes twelve security changes that can affect existing applications and servers and may require configuration updates. Review each change and make the required configuration updates before or immediately after you install the update.
Security changes that require action
FeatureAffectsBehavior after the update
Report template restrictionscfreportColdFusion accepts only .cfr templates inside the calling template's directory tree or an allowed path.
Administrator update endpointsColdFusion Administrator, Package ManagerColdFusion matches the SAML endpoints exactly and requires the update-management role for package install and update.
ObjectLoad in sandboxesObjectLoad()A Java proxy rebuilt by ObjectLoad() needs the same permission as createObject("java").
Sandbox file permission checkscfpdf (processddx), cfimap, cfpop, GCP cloud servicesColdFusion checks the caller's sandbox permissions before it reads or writes files.
cfdocument local sourcescfdocument, cfdocumentsectionColdFusion checks local sources against the sandbox and applies the outbound network policy to http and https sources.
Schema validationserializeProtoBuf()ColdFusion rejects unsafe schema names and paths.
Code generation from WSDL and GraphQLWeb service consumption, GraphQL model generationColdFusion rejects or neutralizes unsafe characters in schema text.
ODBC Socket datasourcesAdministrator datasource settingsColdFusion validates and quotes datasource values.
Multipart upload sizeForm and REST requestsA request can lower the post-size limit but can't raise it.
Special form fieldsForm scopeSpecial fields can no longer overwrite an existing form field.
WebSocket invoke authenticationWebSocket channels, CFC invokeColdFusion denies component invocation from unauthenticated WebSocket connections unless the application opts out.

C++ CFX library allowlist

ColdFusion now validates the file system path of every native C++ CFX library before it loads the library. By default, no paths are allowed, so ColdFusion blocks all native C++ CFX libraries. Java CFX tags aren't affected. ColdFusion resolves each path to its canonical location, so symbolic links and relative path segments can't be used to load a library from outside an allowed location.
To allow a library, add its path to the cppcfxlibrarypaths setting in cf_root/lib/pathfilter.json. Separate multiple paths with semicolons. Each path must be an absolute path or a glob pattern.
{
  "cppcfxlibrarypaths": "/opt/coldfusion2023/cfx/lib/*;/opt/myapp/native/mycfx.so"
}
If you need to turn off path validation, set the following JVM flag. Adobe doesn't recommend this option.
-Dcoldfusion.cppcfx.disableLibraryPathValidation=true
Note: Native CFX tags stop working if you don't add their library paths to the allowlist.

cffeed enclosure download

When you use cffeed to download enclosures, ColdFusion now accepts only HTTP and HTTPS URLs and blocks other URL schemes, such as file://. ColdFusion also validates enclosure file names against the extensions configured in the application's blockedExtForFileUpload setting and applies the outbound URL policy, including validation at every redirect.
If an enclosure's file extension is blocked, ColdFusion doesn't save the file. Depending on the value of ignoreEnclosureError, ColdFusion either skips the blocked enclosure or raises an error.
The shipped default value of blockedExtForFileUpload is:
AS,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,DMG,EXE,HBXML,JSP,JSPX,JWS,MXML,PHP,SWC,SWS,CLASS,JAR,ASMX,ASHX,SH,BAT
Don't replace the default list with a shorter list. If your application needs to block additional file types, retain the existing blocked extensions and add the required extensions to the list.The blockedExtForFileUpload setting also supports the following special values:
  • * blocks all files.
  • :no-extension blocks files that don't have an extension.
The outbound URL policy applies both to the original enclosure URL and to every redirect. If an enclosure URL points to an internal host, add that host to the outbound URL allowlist. If the outbound URL policy blocks an enclosure at either the original URL or a redirect, ColdFusion raises the same generic outbound URL policy error.The following example reads a feed and saves permitted enclosures to a local folder:
component {
    this.name = "myapp";
    this.blockedExtForFileUpload =
        "cfm,cfc,cfml,jsp,php,exe,sh,bat";
}
The following example reads a feed and saves its enclosures to a local folder:
cffeed(
    action="read",
    source="https://news.example.com/rss.xml",
    properties="meta",
    query="entries",
    enclosureDir=expandPath("./downloads")
);
If an expected enclosure isn't downloaded, check the URL scheme, the blockedExtForFileUpload setting, the ignoreEnclosureError setting, and the outbound URL policy. If the enclosure URL or one of its redirects points to an internal host, make sure that host is included in the outbound URL allowlist.

Outbound network security policy

ColdFusion now applies a common outbound network security policy to server-initiated HTTP and HTTPS connections. The policy helps prevent connections to restricted destinations, including private networks, link-local addresses, and cloud metadata services.
The policy applies to outbound connections made by features including cfdocument, cfpresentation, cfpresentationslide, cffeed, cfimage and ImageRead, cfschedule, cfexchange, GraphQL clients, SharePoint WSDL, XML-RPC and SOAP endpoints, WSDL requests, and embedded resources such as images loaded by document and presentation features.
By default, ColdFusion allows connections to public destinations and blocks private network ranges, link-local addresses, and metadata services. ColdFusion also validates destinations after redirects.
Configure the policy for an application
If an application needs to connect to an internal or otherwise blocked destination, add the destination to the application's allowList in Application.cfc:
component {
    this.name = "myapp";
    this.security.outboundNetwork = {
        allowList: ["https://api.internal.example.com"]
    };
}
Configuration key lookup in Application.cfc is case-insensitive.
Configure the policy at the server level
To configure the policy for the server, update the outboundNetwork section in cfusion/lib/security-settings.json. Use the key outboundNetwork with allowList and denyList. Unrecognized keys cause the whole setting to fall back to defaults.
{
  "outboundNetwork": {
    "defaultAction": "allow",
    "allowList": ["https://api.internal.example.com"],
    "denyList": [],
    "blockPrivateNetworks": true,
    "blockLinkLocal": true,
    "blockMetadataServices": true
  }
}
The default server configuration uses an empty allowList and denyList, a defaultAction of "allow", and enables the private-network, link-local, and metadata-service blocks.
Allow-list and deny-list entries
Specify HTTP or HTTPS destinations in the following form:
scheme://host[:port][/path]
For example:
https://api.internal.example.com
https://api.internal.example.com:8443
https://api.internal.example.com/service
  • An entry with no path, or with a trailing /*, matches any path for that destination.
  • Path-specific entries match at path-segment boundaries.
  • CIDR entries, such as https://10.0.0.0/24, match literal IP addresses only. ColdFusion doesn't match hostnames against a CIDR range.
  • Subdomain wildcards aren't supported.
How ColdFusion evaluates the policy
ColdFusion evaluates outbound destinations in the following order:
  1. denyList
  2. allowList
  3. Metadata-service, private-network, and link-local restrictions
  4. defaultAction
A matching denyList entry always blocks the connection. A matching allowList entry overrides the metadata-service, private-network, and link-local restrictions. Therefore, adding an internal destination to the allow list is the supported way to permit an application to connect to that destination. If neither list matches and none of the network restrictions blocks the destination, ColdFusion applies defaultAction.
Server and application settings
ColdFusion combines server-level and application-level outbound network settings restrictively:
  • Server and application allowList entries are combined.
  • Server and application denyList entries are combined.
  • If either configuration sets defaultAction to "deny", the effective default action is deny.
  • Each network-blocking option is enabled if either the server or application enables it. An application therefore can't disable a restriction enabled at the server level.
  • An application can add destinations to its allowList, because the application and server allow lists are combined.
Use "allow" or "deny" for defaultAction. ColdFusion treats an unrecognized value as deny and logs the invalid configuration. If an invalid value is specified in Application.cfc, outbound requests from that application raise an exception.
Blocked connections
When the policy blocks an outbound connection, ColdFusion reports an error similar to:
This URL is not permitted by the outbound network security policy. To allow this connection, add it to outboundNetwork.allowList in security-settings.json or to this.security.outboundNetwork.allowList in Application.cfc.
The exact wording can vary depending on the ColdFusion feature making the request.
Review applications that connect to internal, private, or otherwise restricted destinations and add only the required HTTP or HTTPS destinations to the appropriate allowList.
You can disable SSRF protection by setting the following JVM flag. Adobe doesn't recommend disabling this protection.
-Dcoldfusion.security.ssrf.disableProtection=true

CFC remoting access checks

When you set accessors="true" in a component, ColdFusion generates get and set methods for each property. These synthesized accessors are public by default. Update 14 now applies remoting access checks to synthesized accessors in the same way that it checks explicitly declared methods. As a result, remote clients can no longer invoke generated accessors that aren't eligible for remote access.
The same access check applies to closures invoked through this remoting path. Remote clients can no longer invoke closures through this dispatch mechanism.
This change doesn't affect REST resources. Methods configured as REST resources through restPath, produces, or httpMethod metadata bypass this remoting access check and continue to work as before.
If your application relies on generated accessors for remote calls, declare an explicit remote method that returns only the data that clients need. In the following example, the remote method returns the display name without exposing the ssn property:
component accessors="true" {
    property name="ssn" type="string";
    property name="displayName" type="string";

    remote string function getPublicName() {
        return variables.displayName;
    }
}
Note:
Review remote components that use accessors="true" and explicitly expose each remote operation that your application requires.

cfreport template restrictions

ColdFusion now validates the template attribute of cfreport before it loads the template. A template is accepted only if both of the following are true:
  • The file has the .cfr extension.
  • The file is inside the directory tree of the template that calls cfreport, or inside a path you add to the reporttemplatepath setting.
ColdFusion applies the same check to subreports and to direct requests for .cfr files. A direct request for a .cfr file now works only if the file's path is in the reporttemplatepath allowlist.
To allow report templates from another location, add the path to cf_root/lib/pathfilter.json. Separate multiple paths with semicolons.
{
 "reporttemplatepath": "/opt/myapp/reports/*"
}
If a report fails after the update, ColdFusion logs Report template denied with the reason. Check that the template has the .cfr extension, and that it is in the same directory tree as the calling page or in the allowlist.

ColdFusion Administrator and Package Manager

ColdFusion now matches the SAML login and assertion consumer endpoints exactly. Requests to similar or modified paths require authentication.
The package install and update operations in Package Manager, including installAllBundles and updateAllBundles, require the coldfusion.manageupdates role. Administrator users without this role can no longer start them.
These changes are delivered in the Administrator package. Update the administrator package, not only the core server, so that the changes take effect.

ObjectLoad in sandboxes

When Sandbox Security is enabled, using a Java object proxy that ObjectLoad() reconstructs now requires the same permission as createObject("java", ...). If the sandbox denies createObject("java"), ColdFusion also denies the reconstructed proxy. The restriction on internal ColdFusion Java classes also applies.
ColdFusion components deserialized with ObjectLoad(), session data and cache data are not affected.

Sandbox file permission checks

When Sandbox Security is enabled, ColdFusion now checks the calling application's file permissions before it reads or writes the following paths:
  • Input and output files for cfpdf action="processddx"
  • The attachmentPath for cfimap and cfpop, including file:// paths
  • The credentialJSONFilePath for GCP Storage, Firestore and Pub/Sub
A sandboxed application can use these features only with paths it could access directly. Otherwise ColdFusion raises an access denied error. If an application fails after the update, grant the sandbox the specific file permission that it needs.

cfdocument and cfdocumentsection sources

When Sandbox Security is enabled, cfdocument and cfdocumentsection check file: and jar:file: sources and local paths against the sandbox's file permissions.
  • If the src attribute is denied, ColdFusion raises a security error.
  • If an embedded resource in the content, such as an image, is denied, ColdFusion replaces it with a blank image and logs a warning.
ColdFusion also checks the http and https URL in the src attribute against the outbound network policy. Sub-resources that the rendered HTML references are not covered by this check. See the known issue in the Update 14 tech note. No new JVM flag is added for this change.

serializeProtoBuf validation

serializeProtoBuf() now rejects schema values that:
  • Start with @ or -
  • Are absolute paths outside protoPath
  • Contain path traversal
ColdFusion raises the error Invalid Schema or path. Use a schema file inside protoPath, or inline schema text.

DocumentService parser registration

Custom parsers that you register with DocumentService() now apply only to the application that registered them. ColdFusion identifies the application by the directory of the governing Application.cfc, not by this.name. Register the parser in each application that needs it.

WSDL and GraphQL code generation

ColdFusion generates Java source when it consumes a web service, including SharePoint services, or generates GraphQL models.
WSDL and XSD
ColdFusion rejects a WSDL or XSD document if any attribute value or text value contains a double quote, a backslash, a carriage return or line feed, another control character (tab is allowed), or the sequence */. This includes imported documents. The request fails with an error that names the element. Values of xsd:pattern are exempt for double quotes and backslashes. Text inside documentation elements is sanitized instead of rejected: ColdFusion replaces */ with */ and a backslash with \.
GraphQL
ColdFusion applies the same replacements to the schema description and deprecationReason fields.
If a WSDL stops loading after the update, check the element that the error names for unusual characters.

ODBC Socket datasources

When you save an ODBC Socket datasource, ColdFusion now:
  • Quotes the datasource value in the generated SequeLink command file
  • Rejects control characters, values that contain both quote types, and values longer than 150 characters
  • Names the generated .inp file with a SHA-256 hash instead of the datasource name
This change is delivered in the Administrator package. A core-only update does not include it.

Multipart post-size limit

A client can pass MAX_FILE_SIZE in the query string to change the multipart size limit. The client can now only lower the limit. ColdFusion ignores values above the Maximum size of post data setting, uses the server limit instead, and logs a warning. Zero, negative and invalid values also use the server limit. If an application used MAX_FILE_SIZE to allow larger uploads for a specific request, raise the server setting instead.

Special form fields

Form fields whose names start with __CFTEXT__, __CFSLIDER__ or __CFGRID__, and PDF form field names that ColdFusion translates, can no longer overwrite an existing form field. If the target field already exists, ColdFusion throws CorruptFieldException and returns HTTP 500. Fields that don't collide with an existing field behave as before.

WebSocket invoke authentication

ColdFusion now requires an authenticated WebSocket connection before it invokes a ColdFusion component method for that connection. An unauthenticated connection receives an error and the call is not dispatched.
To allow unauthenticated invocation for a specific application, set the following in Application.cfc. The default is true.
component {
 this.name = "myapp";
 this.wsRequireAuthForInvoke = false;
}
To restore the previous behavior for all applications on the server, set the JVM flag -Dcoldfusion.websocket.requireAuthForInvoke=false. The default is true. Adobe doesn't recommend this option.

Bugs fixed in his update

  • Fixed an issue in the ColdFusion 2023 Docker image where an invalid licenseFilePath could add unintended entries to license.properties or resolve outside /data. The startup script now validates the value and confines the resolved path to /data.
  • Fixed an issue where installing the print package could load older PDF, image, and document bundles alongside current versions, causing PDF functions to fail.
  • Fixed an Admin API authorization issue where valid credentials could be accepted but role-protected calls were denied.
  • Restored Axis package version 2023.0.20.330909 to the ColdFusion 2023 Package Manager’s available versions and Update 25 offline repository.
  • Fixed a startup failure when FusionReactor was configured as a Java agent.
  • Fixed an issue that prevented ColdFusion 2023 from starting after Update 25 when sandbox security was enabled.
  • Fixed SQL identifier validation that rejected Oracle named bind variables with a leading colon and SQL Server bracket-quoted procedure names, while retaining injection protection.
  • Updated the bundled Apache Tomcat version to 9.0.122 in ColdFusion 2023.
  • Improved Exchange connection errors to identify when an outbound URL is blocked by security policy and explain how to allow the connection.
  • Fixed a WDDX deserialization issue by enforcing the configured maximum column count before allocating recordset metadata arrays.
  • Fixed an issue where <cfimap> did not save email attachments to ram:// locations.
  • Fixed REST application registration so it can resolve application-mapped and sibling components, preventing REST initialization and endpoint failures.
  • Fixed Teradata data source creation so JDBC URLs retain the jdbc:teradata:// prefix.

Known issues in this update

cfdocument sub-resource requests
The outbound network security policy applies to the top-level URL that cfdocument retrieves. However, URLs for sub-resources referenced by the rendered HTML aren't currently subject to the same outbound network security checks.
For example, when HTML rendered by cfdocument references an image, stylesheet, CSS import, background image, iframe, or object, the document renderer can make server-side requests to those resources without applying the restrictions that block private networks, link-local addresses, and cloud metadata services.
As a result, an HTML document that contains URLs for internal or cloud metadata destinations can cause the renderer to make requests to those destinations, even when a direct top-level request to the same destination is blocked by the outbound network security policy. If a response can be decoded as an image, the renderer can also include that content in the generated PDF.This limitation has been observed with the following sub-resources:
  • <img>
  • <link rel="stylesheet">
  • CSS @import
  • CSS background-image: url()
  • <iframe>
  • <object>
@font-face and <svg><image> didn't initiate equivalent requests in the document rendering engine.
Until sub-resource requests are subject to the outbound network security policy, don't render untrusted or user-controlled HTML with cfdocument when that HTML can contain external resource URLs.
Restrict or sanitize URLs in rendered content and prevent the ColdFusion server from reaching sensitive internal and cloud metadata endpoints at the network level.

Prerequisites

  1. On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
  2. If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
    • http.proxyHost
    • http.proxyPort
    • http.proxyUser
    • http.proxyPassword
  3. For ColdFusion running on JEE application servers, stop all application server instances before installing the update.

ColdFusion JDK flag requirements

COLDFUSION 2023 (version 2023.0.0.330468) and above

For Application Servers

On JEE installations, set the following JVM flag, " -Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**; !com.mysql.cj.jdbc.interceptors.**;!org.apache.commons.collections.**;", in the respective startup file depending on the type of Application Server being used.
For example:
  • Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
  • WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
  • WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
ou only need to set these JVM flags on a JEE installation of ColdFusion, not on a standalone installation.

Installation

ColdFusion Administrator

In Package Manager > Packages, click Check for Updates in Core Server.
After it detects an update, click Update. The core package gets updated the the latest update.
All installed packages also get updated.
Restart ColdFusion for the changes to take effect.

Install the update in offline mode manually

  1. Download the hotfix installer from the link. (MD5: d37ca2ec4dbf1249a7a5bb05767f93be)
  2. Download the packages zip (MD5: 70426B1258D1020939C15BA9B48C3859) file from this link and extract its contents to a location accessible to all ColdFusion server instances.
     
  3. Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.
You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.
  • Windows: <cf_root>\jre\bin\java.exe -jar <InstallerRepositoryUnzippedPath>\bundles\updateinstallers\hotfix-026-331018.jar
     
  • Linux-based platforms: <cf_root>/jre/bin/java -jar  <InstallerRepositoryUnzippedPath>/bundles/updateinstallers/hotfix-026-331018.jar
If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).
Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.
Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers.
For further details on manually updating the application, see the help article.
 
Note:
If you are on Java 17.0.8 or higher and want to apply the Hotfix manually, use the flag java -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar hotfix.jar.
However, if you are applying the update from the Administrator, you do not require any flag.

Post installation

Note:
After applying this update, the ColdFusion build number should be 2023,0,26,331018

Uninstallation

To uninstall the update, perform one of the following:
  • In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
  • Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2023-00026-331018/uninstall /uninstaller.jar
If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:
  1. Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
  2. Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2023-00026-331018}/backup directory to {cf_install_home}/{instance_name}/
Note:
Uninstalling this update only removes the core update itself. Any ColdFusion packages that were updated as part of this release remain at their latest compatible versions. If you need to revert package versions, you must do so separately; uninstalling the core update does not roll back package versions automatically.
Q: If I uninstall ColdFusion 2023 Update 26, will all the packages installed with it be rolled back?
 A: No. Package rollback depends on the minimum core dependency of each package:
 
  • Packages with a minimum core dependency of update 26 (that is, they specifically require this core level) are rolled back when you uninstall this core update.
  • Packages with a minimum core dependency of update 25 or update 24 remain installed at their latest compatible versions and are not rolled back automatically when you uninstall the core update.

Connector configuration

2023 UpdateConnector recreation required
Update 26
No
However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors:
Update 25
No
However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors:
Update 24
No
However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors:
Update 23
No
However, upgrading from Update 4 and earlier requires you to recreate the connector. View the following for more information on creating and configuring connectors:
Update 22
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 21
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 20
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 19
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 18
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 17
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 16
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 15
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 14
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 13
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 12
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 11
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 10
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 9
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 8
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 7No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 6
No
However, upgrading from Update 4 and earlier requires you to recreate the connector.
View the following for more information on creating and configuring connectors:
Update 5Yes
Update 4No
Update 3No
Update 2No
Update 1No

Package updates

UpdatePackages updated
Update 26
Yes
  • adminapi
  • administrator
  • axis
  • ccs
  • document
  • exchange
  • feed
  • ftp
  • gcpfirestore
  • gcppubsub
  • gcpstorage
  • htmltopdf
  • image
  • print
  • mail
  • pdf
  • presentation
  • report
  • saml
  • scheduler
  • search
  • sharepoint
  • spreadsheet
  • websocket
  • zip
Update 25
Yes
  • adminapi
  • administrator
  • ajax
  • awslambda
  • awss3
  • axis
  • azureblob
  • azureservicebus
  • ccs
  • cfmongodb
  • chart
  • debugger
  • exchange
  • feed
  • ftp
  • gcpfirestore
  • gcppubsub
  • gcpstorage
  • graphqlclient
  • htmltopdf
  • orm
  • ormsearch
  • pdf
  • pmtagent (alias: perfmon)
  • print
  • report
  • saml
  • scheduler
  • search
  • sharepoint
  • websocket
  • zip
Update 24
Yes
  • adminapi
  • administrator
  • chart
  • eventgateways
  • websocket
Update 23
Yes
  • adminapi
  • administrator
  • ajax
  • debugger
  • pmtagent
  • websocket
Update 22
Yes
  • administrator
  • debugger
  • websocket
Update 21
Yes
  • administrator
  • ajax
  • exchange
  • feed
  • mail
  • websocket
Update 20
Yes
  • administrator
  • axis
  • ccs
  • exchange
  • mail
  • sharepoint
Update 19
Yes
  • adminapi
  • administrator
  • CCS
Update 18
Yes
  • image
  • htmltopdf
  • pdf
  • print
  • search
Update 17
Yes
  • administrator
  • ccs
  • document
  • htmltopdf
  • pdf
  • presentation
  • print
  • report
  • scheduler
  • search
  • spreadsheet
  • websocket
Update 16
Yes
  • feed
Update 15
Yes
The following packages are updated:
  • adminapi
  • administrator
  • axis
  • document
  • exchange
  • htmltopdf
  • image
  • pdf
  • presentation
  • print
  • report
  • saml
  • scheduler
  • search
  • sharepoint
  • spreadsheet
Update 14
Yes
The following packages are updated:
  • adminapi
  • administrator
  • document
  • htmltopdf
  • pdf
  • presentation
  • print
  • report
  • scheduler
Update 13
Yes
The following packages are updated:
  • htmltopdf
  • administrator
  • ajax
  • ccs
Update 12
Yes
The pmtagent package is updated.
Update 11Yes
Update 10No
Update 9No
Update 8Yes
Update 7Yes
Update 6No
Update 5Yes
Update 4No
Update 3No
Update 2No
Update 1No

Share this page

Was this page helpful?
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Thank you for your feedback. Your response will help improve this page.

On this page