ColdFusion (2025 release) Update 14

Last update:

Oct 13, 2026

ColdFusion (2025 release) Update 14 tech notes, containing bug fixes, enhancements, and security guidelines.

Security recommendations

For all security updates, Adobe recommends applying the security configuration settings outlined on the ColdFusion Security page and reviewing the respective Lockdown guides.

ColdFusion 2025 Lockdown Guide

Note:

The updates below are cumulative and contain all updates from previous ones. If you are skipping updates, you can apply the latest update, not those you are skipping. Further, you must take note of any changes that are implemented in each of the updates you are skipping.

View ColdFusion (2025 release) Updates for more information.

What's new and changed

ColdFusion (2025 release) Update 14 (release date: October 13, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.

Tomcat upgrade

This security update includes an upgrade to Tomcat v10.1.60.

View the security bulletin, APSB26-144, for more information.

New JVM flags

ColdFusion security JVM flags
JVM flag	Description	Default value
`-Dcoldfusion.websocket.requireAuthForInvoke`	Specifies whether authentication is required when invoking ColdFusion components through WebSocket connections. When enabled, unauthenticated WebSocket clients cannot invoke component methods. The per-application setting `this.wsRequireAuthForInvoke` in Application.cfc also controls this behavior.	`true`
`-Dcoldfusion.security.ssrf.disableProtection`	Specifies whether ColdFusion's Server-Side Request Forgery (SSRF) protection is disabled. By default, the protection is on: ColdFusion applies the outbound network security policy to server-initiated HTTP and HTTPS connections and blocks connections to private networks, link-local addresses, and cloud metadata services unless the destination is in an `allowList`. Set this flag to `true` to disable SSRF protection. Adobe doesn't recommend disabling it. See Outbound network security policy.	`false`
`-Dcoldfusion.saferegex.maxpatternlen`	Specifies the maximum allowed length of a regular expression pattern processed by the SafeRegex implementation.	`1000`
`-Dcoldfusion.saferegex.maxsubjectlen`	Specifies the maximum length of the input string that can be processed by the SafeRegex implementation.	`100000`
`-Dcoldfusion.saferegex.matchtimeoutms`	Specifies, in milliseconds, the maximum amount of time allowed for a SafeRegex match operation.	`250`
`-Dcoldfusion.saferegex.stringfunc.patterncachesize`	Specifies the maximum number of compiled regular expression patterns cached for ColdFusion string functions.	`2000`
`-Dcoldfusion.xml.wstxMaxEntityCount`	Specifies the maximum number of XML entities that the Woodstox XML parser can process while parsing an XML document.	`100000`
`-Dcoldfusion.xml.wstxMaxEntityDepth`	Specifies the maximum nesting depth of XML entities that the Woodstox XML parser can process.	`500`
`-Dcoldfusion.cppcfx.disableLibraryPathValidation`	Specifies whether library path validation for C++ CFX tags is disabled. Set this flag to `true` to disable library path validation.	`false`
`-Dcoldfusion.rds.security.disableFileProtection`	Specifies whether file protection for ColdFusion Remote Development Services (RDS) is disabled. By default, RDS file protection is on and restricts the paths that RDS file operations can access. Set this flag to `true` only if you need to remove the path restriction on RDS file access. Adobe doesn't recommend this.	`false`

View JVM flags in ColdFusion 2025 updates for more information.

Security changes that require action

Update 14 includes twelve security changes that can affect existing applications and servers and may require configuration updates. Review each change and make the required configuration updates before or immediately after you install the update.

Security changes that require action
Feature	Affects	Behavior after the update
Report template restrictions	`cfreport`	ColdFusion accepts only `.cfr` templates inside the calling template's directory tree or an allowed path.
Administrator update endpoints	ColdFusion Administrator, Package Manager	ColdFusion matches the SAML endpoints exactly and requires the update-management role for package install and update.
ObjectLoad in sandboxes	`ObjectLoad()`	A Java proxy rebuilt by `ObjectLoad()` needs the same permission as `createObject("java")`.
Sandbox file permission checks	`cfpdf` (`processddx`), `cfimap`, `cfpop`, GCP cloud services	ColdFusion checks the caller's sandbox permissions before it reads or writes files.
cfdocument local sources	`cfdocument`, `cfdocumentsection`	ColdFusion checks local sources against the sandbox and applies the outbound network security policy to http and https sources.
Schema validation	`serializeProtoBuf()`	ColdFusion rejects unsafe schema names and paths.
Parser registration	`DocumentService()`	Custom parsers are registered per application.
Code generation from WSDL and GraphQL	Web service consumption, GraphQL model generation	ColdFusion rejects or neutralizes unsafe characters in schema text.
ODBC Socket datasources	Administrator datasource settings	ColdFusion validates and quotes datasource values.
Multipart upload size	Form and REST requests	A request can lower the post-size limit but can't raise it.
Special form fields	Form scope	Special fields can no longer overwrite an existing form field.
WebSocket invoke authentication	WebSocket channels, CFC invoke	ColdFusion denies component invocation from unauthenticated WebSocket connections unless the application opts out.

C++ CFX library allowlist

ColdFusion now validates the file system path of every native C++ CFX library before it loads the library. By default, no paths are allowed, so ColdFusion blocks all native C++ CFX libraries. Java CFX tags aren't affected. ColdFusion resolves each path to its canonical location, so symbolic links and relative path segments can't be used to load a library from outside an allowed location.

To allow a library, add its path to the cppcfxlibrarypaths setting in cf_root/lib/pathfilter.json. Separate multiple paths with semicolons. Each path must be an absolute path or a glob pattern.

{

  "cppcfxlibrarypaths": "/opt/coldfusion2025/cfx/lib/*;/opt/myapp/native/mycfx.so"

}

If you need to turn off path validation, set the following JVM flag. Adobe doesn't recommend this option.

-Dcoldfusion.cppcfx.disableLibraryPathValidation=true

Note: Native CFX tags stop working if you don't add their library paths to the allowlist.

MCP STDIO command allowlist

The MCP STDIO transport can now start only commands that are on an allowlist. By default, the allowlist is empty and ColdFusion denies all commands. ColdFusion combines the this.security.mcp.commandWhitelist setting in Application.cfc with the mcp.commandWhitelist setting in cfusion/lib/security-settings.json to build the effective allowlist. ColdFusion now ignores the commandWhitelist setting in the transport configuration.

An allowlist entry can be a bare command name, such as node, or an absolute path. A bare-name entry matches only a command that is also that bare name. It never matches a path such as /tmp/evil/node. Adobe recommends absolute paths, but they aren't required.

ColdFusion rejects environment variables that can change how a process loads code, such as PATH, LD_PRELOAD, DYLD_*, NODE_OPTIONS, PYTHON*, and CLASSPATH. If you set one of these variables with env(...) or addEnvVar, ColdFusion throws an exception. ColdFusion doesn't silently remove the variable from the child process.

To update your configuration, move your allowlist entries to Application.cfc or to cfusion/lib/security-settings.json. In Application.cfc, add the following:

component {

    this.name = "myapp";

    this.security.mcp.commandWhitelist = [

        "/usr/bin/node",

        "/usr/bin/python3"

    ];

}

In cfusion/lib/security-settings.json, add the following:

{

  "mcp": {

    "commandWhitelist": [

      "/usr/bin/node",

      "/usr/bin/python3"

    ]

  }

}

In your MCP client, you can specify the absolute path of the command:

client = new MCPClient({

    transport: "stdio",

    command: "/usr/bin/node",

    args: ["/opt/mcp/server.js"]

});

Outbound network security policy

ColdFusion now applies a common outbound network security policy to server-initiated HTTP and HTTPS connections. The policy helps prevent connections to restricted destinations, including private networks, link-local addresses, and cloud metadata services.

The policy applies to outbound connections made by features including cfdocument, cfpresentation, cfpresentationslide, cffeed, cfimage and ImageRead, cfschedule, cfexchange, GraphQL clients, AI RAG loaders, MCP resources and MCP over HTTP, SharePoint WSDL, XML-RPC and SOAP endpoints, WSDL requests, and embedded resources such as images loaded by document and presentation features.

By default, ColdFusion allows connections to public destinations and blocks private network ranges, link-local addresses, and metadata services. ColdFusion also validates destinations after redirects.

Configure the policy for an application

If an application needs to connect to an internal or otherwise blocked destination, add the destination to the application's allowList in Application.cfc:

component {

    this.name = "myapp";

    this.security.outboundNetwork = {

        allowList: ["https://api.internal.example.com"]

    };

}

Configuration key lookup in Application.cfc is case-insensitive.

Configure the policy at the server level

To configure the policy for the server, update the outboundNetwork section in cfusion/lib/security-settings.json. Use the key outboundNetwork with allowList and denyList. Unrecognized keys cause the whole setting to fall back to defaults.

{

  "outboundNetwork": {

    "defaultAction": "allow",

    "allowList": ["https://api.internal.example.com"],

    "denyList": [],

    "blockPrivateNetworks": true,

    "blockLinkLocal": true,

    "blockMetadataServices": true

  }

}

The default server configuration uses an empty allowList and denyList, a defaultAction of "allow", and enables the private-network, link-local, and metadata-service blocks.

Allow-list and deny-list entries

Specify HTTP or HTTPS destinations in the following form:

scheme://host[:port][/path]

For example:

https://api.internal.example.com

https://api.internal.example.com:8443

https://api.internal.example.com/service

An entry with no path, or with a trailing /*, matches any path for that destination.
Path-specific entries match at path-segment boundaries.
CIDR entries, such as https://10.0.0.0/24, match literal IP addresses only. ColdFusion doesn't match hostnames against a CIDR range.
Subdomain wildcards aren't supported.

How ColdFusion evaluates the policy

ColdFusion evaluates outbound destinations in the following order:

denyList
allowList
Metadata-service, private-network, and link-local restrictions
defaultAction

A matching denyList entry always blocks the connection. A matching allowList entry overrides the metadata-service, private-network, and link-local restrictions. Therefore, adding an internal destination to the allow list is the supported way to permit an application to connect to that destination. If neither list matches and none of the network restrictions blocks the destination, ColdFusion applies defaultAction.

Server and application settings

ColdFusion combines server-level and application-level outbound network settings restrictively:

Server and application allowList entries are combined.
Server and application denyList entries are combined.
If either configuration sets defaultAction to "deny", the effective default action is deny.
Each network-blocking option is enabled if either the server or application enables it. An application therefore can't disable a restriction enabled at the server level.
An application can add destinations to its allowList, because the application and server allow lists are combined.

Use "allow" or "deny" for defaultAction. ColdFusion treats an unrecognized value as deny and logs the invalid configuration. If an invalid value is specified in Application.cfc, outbound requests from that application raise an exception.

Blocked connections

When the policy blocks an outbound connection, ColdFusion reports an error similar to:

This URL is not permitted by the outbound network security policy. To allow this connection, add it to outboundNetwork.allowList in security-settings.json or to this.security.outboundNetwork.allowList in Application.cfc.

The exact wording can vary depending on the ColdFusion feature making the request.

Review applications that connect to internal, private, or otherwise restricted destinations and add only the required HTTP or HTTPS destinations to the appropriate allowList.

You can disable SSRF protection by setting the following JVM flag. Adobe doesn't recommend disabling this protection.

-Dcoldfusion.security.ssrf.disableProtection=true

cffeed enclosure download

When you use cffeed to download enclosures, ColdFusion now accepts only HTTP and HTTPS URLs and blocks other URL schemes, such as file://. ColdFusion also validates enclosure file names against the extensions configured in the application's blockedExtForFileUpload setting and applies the outbound network security policy, including validation at every redirect.

If an enclosure's file extension is blocked, ColdFusion doesn't save the file. Depending on the value of ignoreEnclosureError, ColdFusion either skips the blocked enclosure or raises an error.

The shipped default value of blockedExtForFileUpload is:

AS,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,DMG,EXE,HBXML,JSP,JSPX,JWS,MXML,PHP,SWC,SWS,CLASS,JAR,ASMX,ASHX

Don't replace the default list with a shorter list. If your application needs to block additional file types, retain the existing blocked extensions and add the required extensions to the list. The following example keeps every extension in the default list and adds SH and BAT:

component {

    this.name = "myapp";

    this.blockedExtForFileUpload =

        "AS,ASP,ASPX,BIN,CFC,CFM,CFML,CFR,CFSWF,DMG,EXE,HBXML,JSP,JSPX,JWS,MXML,PHP,SWC,SWS,CLASS,JAR,ASMX,ASHX,SH,BAT";

}

The blockedExtForFileUpload setting also supports the following special values:

* blocks all files.
:no-extension blocks files that don't have an extension.

The outbound network security policy applies both to the original enclosure URL and to every redirect. If an enclosure URL points to an internal host, add that host to the allowList. If the policy blocks an enclosure at either the original URL or a redirect, ColdFusion raises the same generic outbound network security policy error.

The following example reads a feed and saves its enclosures to a local folder:

cffeed(

    action="read",

    source="https://news.example.com/rss.xml",

    properties="meta",

    query="entries",

    enclosureDir=expandPath("./downloads")

);

If an expected enclosure isn't downloaded, check the URL scheme, the blockedExtForFileUpload setting, the ignoreEnclosureError setting, and the outbound network security policy. If the enclosure URL or one of its redirects points to an internal host, make sure that host is included in the allowList.

CFC remoting access checks

When you set accessors="true" in a component, ColdFusion generates get and set methods for each property. These synthesized accessors are public by default. Update 14 now applies remoting access checks to synthesized accessors in the same way that it checks explicitly declared methods. As a result, remote clients can no longer invoke generated accessors that aren't eligible for remote access.

The same access check applies to closures invoked through this remoting path. Remote clients can no longer invoke closures through this dispatch mechanism.

This change doesn't affect REST resources. Methods configured as REST resources through restPath, produces, or httpMethod metadata bypass this remoting access check and continue to work as before.

If your application relies on generated accessors for remote calls, declare an explicit remote method that returns only the data that clients need. In the following example, the remote method returns the display name without exposing the ssn property:

component accessors="true" {

    property name="ssn" type="string";

    property name="displayName" type="string";

    remote string function getPublicName() {

        return variables.displayName;

    }

}

Note:

Review remote components that use accessors="true" and explicitly expose each remote operation that your application requires.

cfreport template restrictions

ColdFusion now validates the template attribute of cfreport before it loads the template. A template is accepted only if both of the following are true:

The file has the .cfr extension.
The file is inside the directory tree of the template that calls cfreport, or inside a path you add to the reporttemplatepath setting.

ColdFusion applies the same check to subreports and to direct requests for .cfr files. A direct request for a .cfr file now works only if the file's path is in the reporttemplatepath allowlist.

To allow report templates from another location, add the path to cf_root/lib/pathfilter.json. Separate multiple paths with semicolons.

{

 "reporttemplatepath": "/opt/myapp/reports/*"

}

If a report fails after the update, ColdFusion logs Report template denied with the reason. Check that the template has the .cfr extension, and that it is in the same directory tree as the calling page or in the allowlist.

ColdFusion Administrator and Package Manager

ColdFusion now matches the SAML login and assertion consumer endpoints exactly. Requests to similar or modified paths require authentication.

The package install and update operations in Package Manager, including installAllBundles and updateAllBundles, require the coldfusion.manageupdates role. Administrator users without this role can no longer start them.

These changes are delivered in the Administrator package. Update the administrator package, not only the core server, so that the changes take effect.

ObjectLoad in sandboxes

When Sandbox Security is enabled, using a Java object proxy that ObjectLoad() reconstructs now requires the same permission as createObject("java", ...). If the sandbox denies createObject("java"), ColdFusion also denies the reconstructed proxy. The restriction on internal ColdFusion Java classes also applies.

ColdFusion components deserialized with ObjectLoad(), session data and cache data are not affected.

Sandbox file permission checks

When Sandbox Security is enabled, ColdFusion now checks the calling application's file permissions before it reads or writes the following paths:

Input and output files for cfpdf action="processddx"
The attachmentPath for cfimap and cfpop, including file:// paths
The credentialJSONFilePath for GCP Storage, Firestore and Pub/Sub

A sandboxed application can use these features only with paths it could access directly. Otherwise ColdFusion raises an access denied error. If an application fails after the update, grant the sandbox the specific file permission that it needs.

cfdocument and cfdocumentsection sources

When Sandbox Security is enabled, cfdocument and cfdocumentsection check file: and jar:file: sources and local paths against the sandbox's file permissions.

If the src attribute is denied, ColdFusion raises a security error.
If an embedded resource in the content, such as an image, is denied, ColdFusion replaces it with a blank image and logs a warning.

ColdFusion also checks the http and https URL in the src attribute against the outbound network policy. Sub-resources that the rendered HTML references are not covered by this check. See the known issue in the Update 14 tech note. No new JVM flag is added for this change.

serializeProtoBuf validation

serializeProtoBuf() now rejects schema values that:

Start with @ or -
Are absolute paths outside protoPath
Contain path traversal

ColdFusion raises the error Invalid Schema or path. Use a schema file inside protoPath, or inline schema text.

DocumentService parser registration

Custom parsers that you register with DocumentService() now apply only to the application that registered them. ColdFusion identifies the application by the directory of the governing Application.cfc, not by this.name. Register the parser in each application that needs it.

WSDL and GraphQL code generation

ColdFusion generates Java source when it consumes a web service, including SharePoint services, or generates GraphQL models.

WSDL and XSDColdFusion rejects a WSDL or XSD document if any attribute value or text value contains a double quote, a backslash, a carriage return or line feed, another control character (tab is allowed), or the sequence */. This includes imported documents. The request fails with an error that names the element. Values of xsd:pattern are exempt for double quotes and backslashes. Text inside documentation elements is sanitized instead of rejected: ColdFusion replaces */ with *&#47; and a backslash with &#92;.
GraphQLColdFusion applies the same replacements to the schema description and deprecationReason fields.

If a WSDL stops loading after the update, check the element that the error names for unusual characters.

ODBC Socket datasources

When you save an ODBC Socket datasource, ColdFusion now:

Quotes the datasource value in the generated SequeLink command file
Rejects control characters, values that contain both quote types, and values longer than 150 characters
Names the generated .inp file with a SHA-256 hash instead of the datasource name

This change is delivered in the Administrator package. A core-only update does not include it.

Multipart post-size limit

A client can pass MAX_FILE_SIZE in the query string to change the multipart size limit. The client can now only lower the limit. ColdFusion ignores values above the Maximum size of post data setting, uses the server limit instead, and logs a warning. Zero, negative and invalid values also use the server limit. If an application used MAX_FILE_SIZE to allow larger uploads for a specific request, raise the server setting instead.

Special form fields

Form fields whose names start with __CFTEXT__, __CFSLIDER__ or __CFGRID__, and PDF form field names that ColdFusion translates, can no longer overwrite an existing form field. If the target field already exists, ColdFusion throws CorruptFieldException and returns HTTP 500. Fields that don't collide with an existing field behave as before.

WebSocket invoke authentication

ColdFusion now requires an authenticated WebSocket connection before it invokes a ColdFusion component method for that connection. An unauthenticated connection receives an error and the call is not dispatched.

To allow unauthenticated invocation for a specific application, set the following in Application.cfc. The default is true.

component {

 this.name = "myapp";

 this.wsRequireAuthForInvoke = false;

}

To restore the previous behavior for all applications on the server, set the JVM flag -Dcoldfusion.websocket.requireAuthForInvoke=false. The default is true. Adobe doesn't recommend this option.

Bugs fixed in the update

Administrator, installation, and services

Fixed an issue that could prevent the ColdFusion service from starting when FusionReactor was configured as a Java agent.
Fixed update-level metadata in hotfix full installers so the installer no longer reports an outdated update level.
Fixed an issue that could prevent a core update from being uninstalled through the ColdFusion Administrator because valid installer contents were rejected during signature verification.

Language, database, and AI

Fixed Global Script Protection handling that could double-escape entity-encoded tag text, corrupting plain-text values such as iframe text.
Updated SQL identifier validation to support Oracle named bind parameters with a leading colon and SQL Server bracket-quoted procedure names, while continuing to reject unsafe identifiers.
Fixed a class-loading issue that could prevent the RAG feature from initializing in ColdFusion 2025.
Added a JVM option to disable SSRF protection for deployments that require MCP access to loopback addresses. Because this disables protection, use it only when appropriate for your environment.
Fixed WDDX recordset handling to reject fieldNames column counts above the configured maximum before allocating metadata arrays.
Fixed an issue in ColdFusion 2025 where using a permitted VFS source, such as an s3:// path, in <cfdocumentsection src> could fail with a NoClassDefFoundError and prevent PDF generation.

Security, dependencies, and connectivity

Updated bundled OpenNLP and Bouncy Castle libraries to versions that address the vulnerabilities identified in the dependency scan.
Improved the error reported when an Exchange connection is blocked by outbound network security policy, including more actionable guidance for allowing the destination.

Known issues in this update

cfdocument sub-resource requests

The outbound network security policy applies to the top-level URL that cfdocument retrieves. However, URLs for sub-resources referenced by the rendered HTML aren't currently subject to the same outbound network security checks.

For example, when HTML rendered by cfdocument references an image, stylesheet, CSS import, background image, iframe, or object, the document renderer can make server-side requests to those resources without applying the restrictions that block private networks, link-local addresses, and cloud metadata services.

As a result, an HTML document that contains URLs for internal or cloud metadata destinations can cause the renderer to make requests to those destinations, even when a direct top-level request to the same destination is blocked by the outbound network security policy. If a response can be decoded as an image, the renderer can also include that content in the generated PDF.

This limitation has been observed with the following sub-resources:

<img>
<link rel="stylesheet">
CSS @import
CSS background-image: url()
<iframe>
<object>

@font-face and <svg><image> didn't initiate equivalent requests in the document rendering engine.

Until sub-resource requests are subject to the outbound network security policy, don't render untrusted or user-controlled HTML with cfdocument when that HTML can contain external resource URLs.

Restrict or sanitize URLs in rendered content and prevent the ColdFusion server from reaching sensitive internal and cloud metadata endpoints at the network level.

Prerequisites

On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
- http.proxyHost
- http.proxyPort
- http.proxyUser
- http.proxyPassword
For ColdFusion running on JEE application servers, stop all application server instances before installing the update.

ColdFusion JDK flag requirements

ColdFusion 2025 (version 2025.0.0.331385)

For Application Servers

Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file

Set the JVM flags on a JEE installation of ColdFusion, not on a standalone installation.

Installation

ColdFusion Administrator

In Package Manager > Packages, click Check for Updates in Core Server.

After it detects an update, click Update. The core package gets updated the latest update.

All installed packages also get updated.

Restart ColdFusion for the changes to take effect.

Install the update in offline mode manually

Download the hotfix installer from the link. MD5: b1c03e86ace3295d077ba1a382b65a89
Download the packages zip (MD5: 94BB7838506CA6E00705C47636845789) file from this link and extract its contents to a location accessible to all ColdFusion server instances.
Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.

You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.

Windows: <cf_root>\jre\bin\java.exe -jar <InstallerRepositoryUnzippedPath>\bundles\updateinstallers\hotfix-014-332029.jar
Linux-based platforms: <cf_root>/jre/bin/java -jar <InstallerRepositoryUnzippedPath>/bundles/updateinstallers/hotfix-014-332029.jar

If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).

Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.

Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers.

For further details on manually updating the application, see the help article.

Post installation

Note:

After applying this update, the ColdFusion build number should be 2025,0,14,332029

Uninstallation

To uninstall the update, perform one of the following:

In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2025-00014-332029/uninstall /uninstaller.jar

If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:

Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2025-00014-332029}/backup directory to {cf_install_home}/{instance_name}/

Note:

Uninstalling this update only removes the core update itself. Any ColdFusion packages that were updated as part of this release remain at their latest compatible versions. If you need to revert package versions, you must do so separately; uninstalling the core update does not roll back package versions automatically.

Frequently asked questions

If I uninstall ColdFusion 2025 Update 14, will all the packages installed with it be rolled back?

No. Package rollback depends on the minimum core dependency of each package:

Packages with a minimum core dependency of update 14 (that is, they specifically require this core level) are rolled back when you uninstall this core update.
Packages with a minimum core dependency of Update 12 or Update 13 remain installed at their latest compatible versions and are not automatically rolled back when you uninstall the core update.

Connector configuration

2025 Update	Connector recreation required
Update 14	No
Update 13	No
Update 12	No
Update 11	No
Update 10	No
Update 9	No
Update 8	No
Update 7	No
Update 6	No
Update 5	No
Update 4	No
Update 3	No
Update 2	No
Update 1	No

Package updates

2025 Update	Packages updated
Update 14	Yes adminapi administrator ai axis ccs document exchange feed gcpfirestore gcppubsub gcpstorage htmltopdf image mail msgraph presentation print pdf report scheduler sharepoint websocket
Update 13	Yes adminapi administrator chart eventgateways websocket
Update 12	Yes adminapi administrator ajax ai debugger pmtagent websocket
Update 11	Yes administrator debugger document pdf htmltopdf presentation print report websocket
Update 10	Yes administrator ajax exchange feed mail websocket ai
Update 9	Yes administrator ccs exchange mail
Update 8	Yes ai
Update 7	Yes adminapi administrator CCS
Update 6	Yes image htmltopdf msgraph pdf print search
Update 5	Yes administrator ccs document htmltopdf pdf presentation print report scheduler search spreadsheet websocket
Update 4	Yes feed
Update 3	The following packages are updated: adminapi administrator axis document htmltopdf pdf presentation print report scheduler search sharepoint spreadsheet
Update 2	The following packages are updated: adminapi administrator document htmltopdf pdf presentation print report scheduler
Update 1	The following packages are updated: administrator ajax

Was this page helpful?

We're glad. Tell us how this page helped.

Found the answer to my problem Understood the instructions Liked the feature

Other suggestions

We're sorry. Can you tell us what didn't work for you?

Didn't find the answer to my problem Couldn't understand the instructions Didn't like the feature

Other suggestions

Thank you for your feedback. Your response will help improve this page.

Was this helpful?

We are sorry the content didn't meet your needs.

Share additional feedback to help us improve.

0/255 | Character limit exceeded.

Thank you so much for sharing your feedback!

ColdFusion (2025 release) Update 14

Security recommendations

What's new and changed

Security changes that require action

C++ CFX library allowlist

MCP STDIO command allowlist

Outbound network security policy

cffeed enclosure download

CFC remoting access checks

cfreport template restrictions

ColdFusion Administrator and Package Manager

ObjectLoad in sandboxes

Sandbox file permission checks

cfdocument and cfdocumentsection sources

serializeProtoBuf validation

DocumentService parser registration

WSDL and GraphQL code generation

ODBC Socket datasources

Multipart post-size limit

Special form fields

WebSocket invoke authentication

Bugs fixed in the update

Known issues in this update

Prerequisites

ColdFusion JDK flag requirements

ColdFusion 2025 (version 2025.0.0.331385)

Installation

ColdFusion Administrator

Install the update in offline mode manually

Post installation

Uninstallation

Connector configuration

Package updates

On this page