ColdFusion (2023 release) updates

ColdFusion (2023 release) Update 25 (release date: September 23, 2026) includes extensive OEM library upgrades, enhancements to Query-of-Queries, query metadata handling, and the spread operator, along with fixes across ColdFusion Administrator, SFTP, Solr, MongoDB, SendGrid, scheduled tasks, GraphQL, Redis configuration, and other core and package functionality.

For more details, see the tech note.

Type: General

File: ColdFusion (2023 release) Update 25 (MD5: 123853a4960fd9baf65c3c7c2325ec45)

Hotfix and packages repository: Link (MD5: c109e1c1058d7c06f6729422b99f252b)

Build Number: 2023,0,25,330977

ColdFusion (2023 release) Update 24 (release date: September 08, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure.

View the security bulletin, APSB26-119, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2023 release) Update 24 (MD5: aad04a4d433eafbdd94031d20a3b3126)

Hotfix and packages repository: Link (MD5: c787ae31c2fa6b9af1ff0d30d8f89549)

Build Number: 2023,0,24,330957

ColdFusion (2023 release) Update 23 (release date: August 11, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure. The update also contains an upgraded Tomcat version 9.0.120.0.

View the security bulletin, APSB26-90, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2023 release) Update 23 (MD5: d61097401311fd9833300cab1b20d9c1)

Hotfix and packages repository: Link (MD5: 2805cb4ace42b63fe8d66a741ece6f8f)

Build Number: 2023,0,23,330940

ColdFusion (2023 release) Update 22 (release date: 14 July, 2026) resolves critical vulnerabilities that could lead to arbitrary code execution, privilege escalation, and security feature bypass.

View the security bulletin, APSB26-82, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2023 release) Update 22 (MD5: 4ffaab97dabfc53e274953308e54adab)

Hotfix and packages repository: Link (MD5: 03b52f9c04826deec196cfcf31497a38)

Build Number: 2023,0,22,330928

ColdFusion (2023 release) Update 21 (release date: 30 June, 2026) resolves critical vulnerabilities that could lead to arbitrary code execution, privilege escalation, and security feature bypass.

View the security bulletin, APSB26-68, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2023 release) Update 21 (MD5: 51b86e6d9c9f35831546d2cef62bc376)

Hotfix and packages repository: Link (MD5: c3fdc5cb6d383400fc9c6f1a9cdc6d5c )

Build Number: 2023,0,21,330920

ColdFusion (2023) Update 20 (release date: 9 June, 2026) includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.118.

View the security bulletin, APSB26-64, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2023 release) Update 20 (MD5: f0f29b4fac46a7f6ac5b189992985a04)

Hotfix and packages repository: Link (MD5: 660cf3778d0b0b418361585bd5f38659)

Build Number: 2023,0,20,330909

ColdFusion (2023) Update 19 (release date: 14 April, 2026) includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, application denial-of-service, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.116.0.

View the security bulletin, APSB26-38, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 19 (MD5: e3915aee7452b53e4482b49cdf5f9eb1)

Hotfix and packages repository: Link (MD5: abadf165020f83b3c96701b3057c481f)

Build Number: 2023,0,19,330899

ColdFusion (2023 release) Update 18 (release date: 13 January, 2026) addresses CVE-2025-66516, a critical XXE in Apache Tika libraries. Adobe strongly recommends that you apply this update as soon as possible. Note that this update is cumulative and includes fixes from previous updates. 

ColdFusion (2023 release) Update 18 includes Apache Tika version 2.9.4, which is the latest supported version for this release. Due to compatibility and compliance requirements, Apache Tika 3.x is not included in ColdFusion 2023.

To address CVE-2025-66516, Adobe has backported the required security fixes into the Apache Tika 2.9.4 version shipped with ColdFusion 2023 Update 18. As a result, ColdFusion 2023 Update 18 is protected against CVE-2025-66516, even though the Apache Tika version number is lower than 3.x.

Some vulnerability scanners may continue to report this CVE based solely on the Apache Tika version string.

View the security bulletin, APSB26-12, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 18 (MD5: 87c9cbacd1ea6694865674b114918abb)

Hotfix and packages repository: Link (MD5: 8dd96678485def13893fd5ef90c16245)

Build Number: 2023,0,18,330879

ColdFusion (2023 release) Update 17 (release date, 9 December 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 9.0.111.0.

View the security bulletin, APSB25-105, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 17 (MD5: 09de89142ef3a4311391a53419489bcc)

Hotfix and packages repository: Link (MD5: effda3dda03c5175d272cbc9c67dcd44)

Build Number: 2023,0,17,330864

ColdFusion (2023 release) Update 16 (release date, 9 September, 2025) addresses an important security fix related to critical path traversal.

View the security bulletin, APSB25-93, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 16 (MD5: 54813fbeefa2c5990fbac4cd89ed9639)

Hotfix and packages repository: Link (MD5: eaf7227495a12d7cc0b3605030d6c6c6)

Build Number: 2023,0,16,330828

ColdFusion (2023 release) Update 15 (release date, July 8, 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass.

The update also upgrades the underlying Tomcat engine to version 9.0.106 and resolves several issues reported in earlier updates.

View the security bulletin, APSB25-69, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 15 (MD5: 145da616a376ae41357340da07bd3d7c)

Hotfix and packages repository: Link (MD5: ab2ab6a30ec3ac5ebfeb3faac8aeca29)

Build Number: 2023,0,15,330825

View the security bulletin, APSB25-52, for more information.

Type: Security

File: ColdFusion (2023 release) Update 14 (MD5: f4f278280daa20fe635144dc1deb7ea5)

Hotfix and packages repository: Link (MD5: 2c199240ceca69096b68794d8f683fab)

Build Number: 2023,0,14,330784

View the security bulletin, APSB25-15, for more information.

Type: Security

File: ColdFusion (2023 release) Update 13 (MD5: b9b3690c7829693325dba0ba037649db)

Hotfix and packages repository: Link (MD5: 1801670c3804fec22edc2d3acb05d372)

Build Number: 2023,0,13,330759

View the security bulletin, APSB24-107, for more information.

Type: Security

File: ColdFusion (2023 release) Update 12 (MD5: cab3018d9c64cdf578bdf2de28746889)

Hotfix and packages repository: Link (MD5: f766e21b0152afce46923be9da730c90)

Build Number: 2023,0,12,330713

ColdFusion (2023 release) Update 11 (release date, October 15, 2024)  includes bug fixes and enhancements in Administrator, Language, CFSetup, Database, and other areas. The update also contains library upgrades, such as Jackson-data-bind, netty, ehcache, etc.

For more details, see this article.

Type: General

File: ColdFusion (2023 release) Update 11 (MD5: 43cb92b3eb072f68cf55e6c8994de0e2)

Hotfix and packages repository: Link (MD5: 2b4c02eb54d4e241f582b3349dfbfd5e)

ColdFusion (2023 release) Update 10 (release date, September 10, 2024) resolves a critical vulnerability that could lead to the deserialization of untrusted data. View the security bulletin, APSB24-71, for more information.

Type: Security

File: ColdFusion (2023 release) Update 10 (MD5: 4482a8591ac41012864a21cab8019561)

Hotfix and packages repository: Link (MD5:a1823b038e68ff9221a351c6a7c17779)

Type: General

File: ColdFusion (2023 release) Update 9 (MD5: 4c2ab5341cea786aabfe1716db2c262f)

Hotfix and packages repository: Link (MD5: 90881a521fd0e6f3ddd25b38ac12d2a2)

Type: Security

File: ColdFusion (2023 release) Update 8 (MD5: eb83e37a682f02ad9ba8e4cfddb32b13)

Hotfix and packages repository: Link (MD5: 1b2c8711197f932a994b5280492ccb7d)

ColdFusion (2023 release) Update 7 (release date, 12 March, 2024) addresses vulnerabilities mentioned in the security bulletin, APSB24-14.

Type: Security

File: ColdFusion (2023 release) Update 7 (MD5: 2b0f5588a81851f1e7bf874dd60bae8e)

Hotfix and packages repository: Link (MD5: 0a643cc62929976f6cc880ed2c3ccbf5)

Build Number: 2023,0,7,330663

ColdFusion (2023 release) Update 6 (release date, 14 November, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-52.

Type: Security

File: ColdFusion (2023 release) Update 6 (MD5: 1d7a8944c790da9d093a8ec81a8c7156)

Hotfix and packages repository: Link (MD5: ce94dbe4b7477e011dc01d825570dba8)

ColdFusion (2023 release) Update 5 (release date: October 5, 2023) includes bug fixes and enhancements in Administrator, Installer, Migration, Package manager, Database, and other areas. The update contains upgrades to Tomcat (v9.0.78) and other libraries, such as jackson-databind, Netty, etc. Note that this update is cumulative and includes fixes from the previous updates.

Type: General

File: ColdFusion (2023 release) Update 5 (MD5: 149975e2324eda2c9fb4c17506ba0fc6)

Hotfix and packages repository: Link (MD5: 45faef8b991db1925265cfcf410d9f20)

ColdFusion (2023 release) Update 4 (release date, 17 August, 2023) introduces the ColdFusion serial filter that can be used to allow or disallow Java classes or packages for the deserialization of Wddx packets.

Type: General

File: ColdFusion (2023 release) Update 4 (MD5: d32b2d16ed4b5d8689f1db234d924318)

Hotfix and packages repository: Link (MD5: c89329ab072cf3f5a513dd6fc91ab2b1)

ColdFusion (2023 release) Update 3 (release date, 19 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-47.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 3 (MD5: 723c3351b4921db90adf66cd8056df45)

Hotfix and packages repository: Link (MD5: dd87c0ca90d049834b1ab450a994eb6a)

ColdFusion (2023 release) Update 2 (release date, 14 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-41.

For more details, see this article.

Type: Security

File: ColdFusion (2023 release) Update 2 (MD5: 078a2e6b63f4ee0cca3c4aabfdf3666c)

ColdFusion (2023 release) Update 1 (release date, 11 July, 2023) addresses vulnerabilities that are mentioned in the security bulletin, APSB23-40.

For more details, see this article.

Type: General

File: ColdFusion (2023 release) Update 1 (MD5: 8e631f96ead408740a46b0f5c66706be)