ColdFusion (2025 release) updates

ColdFusion (2025 release) Update 12 (release date: August 11, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure. This update also contains an upgraded Tomcat version 10.1.57.

View the security bulletin, APSB26-90, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2025 release) Update 12 (MD5: 1aaf432b9ae7050c193dd2fbc81b7f47)

Hotfix and packages repository: Link (MD5: eefdaab30ffb709212b17284cbe0bf4f)

Build Number: 2025,0,12,331922

ColdFusion (2025) Update 11 (release date: 14 July, 2026) resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.

View the security bulletin, APSB26-82, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2025 release) Update 11 (MD5: 92c2bcf2c7b6c2b8fb14e0c5ff7cdfe1)

Hotfix and packages repository: Link (MD5: 2ae527991242c5c77ad76471d5af9401)

Build Number: 2025,0,11,331909

ColdFusion (2025) Update 10 (release date: 30 June, 2026) resolves critical vulnerabilities that could lead to arbitrary code execution, privilege escalation, and security feature bypass.

View the security bulletin, APSB26-68, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2025 release) Update 10 (MD5: 67eceebb241c6256952edbea8cd59bdc )

Hotfix and packages repository: Link (MD5: 0b11e7ad0dcf00aa17579b4ac1551af4)

Build Number: 2025,0,10,331899

ColdFusion (2025) Update 9 (release date: 9 June, 2026) includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, arbitrary file write, information disclosure, stored cross-site scripting, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 10.1.55.

View the security bulletin, APSB26-64, for more information.

For more details, see the tech note.

Type: Security

File: ColdFusion (2025 release) Update 9 (MD5: 6ad593f755ea14d1781be7d7cf17b922)

Hotfix and packages repository: Link (MD5: 99668a21e08badfb10adb239eda1c442)

Build Number: 2025,0,09,331885

ColdFusion (2025) Update 8(release date: 20 May, 2026) introduces six major capability areas: native AI and LLM integration, Model Context Protocol (MCP) support, vector stores and retrieval augmented generation (RAG), security enhancements, developer tooling improvements, and language and performance updates.

For more details, What's new in ColdFusion 2025.0.08.

Type: General

File: ColdFusion (2025 release) Update 8 (MD5: 68237c064100b80cf66e9c456c3452b5)

Hotfix and packages repository: Link (MD5: 0c5b586fdbf3a761366972fe7515ee1d)

Build Number: 2025,0,08,331874

ColdFusion (2025) Update 7 (release date: 14 April, 2026) includes important security fixes that mitigate vulnerabilities related to arbitrary code execution, application denial-of-service, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 10.1.53.0.

View the security bulletin, APSB26-38, for more information.

For more details, see this article.

Type: Security

File: ColdFusion (2025 release) Update 7 (MD5: dcc8a1cd371e0096f5ac9545d5819976)

Hotfix and packages repository: Link (MD5: 26e1b2ab0a7ffaf831c8a1314ba138ce)

Build Number: 2025,0,07,331586

ColdFusion (2025 release) Update 6 (release date: 13 January, 2026) addresses CVE-2025-66516, a critical XXE in Apache Tika libraries. Adobe strongly recommends that you apply this update as soon as possible. Note that this update is cumulative and includes fixes from previous updates. 

This update upgrades the embedded Apache Tika libraries in ColdFusion to Apache Tika 3.2.3, providing the latest security and stability enhancements, while preserving existing application behavior.

For more details, see this article.

View the security bulletin, APSB26-12, for more information.

Type: Security

File: ColdFusion (2025 release) Update 6 (MD5: 9bf3bf64b9de1ee473b63835cdd0a074)

Hotfix and packages repository: Link (MD5: b4eed196596966bceb32ec81b37972ef)

Build Number: 2025,0,06,331564

ColdFusion (2025 release) Update 5 (release date, 9 December 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 10.1.48.0.

View the security bulletin, APSB25-105, for more information.

Type: Security

File: ColdFusion (2025 release) Update 5 (MD5: 797e27122a8b0d81c1eda50a0e05119b)

Hotfix and packages repository: Link (MD5: 3e9d625a8235d4893c70c7d7d0f5961f)

Build Number: 2025,0,05,331552

ColdFusion (2025 release) Update 4 (release date, 9 September, 2025) addresses an important security fix related to critical path traversal.

View the security bulletin, APSB25-93, for more information.

Type: Security

File: ColdFusion (2025 release) Update 4 (MD5: 8af7861fa6310574d6adabeba1cc234b)

Hotfix and packages repository: Link (MD5: c5ea8e6dbd5171c73eb18c9d06104ce1)

Build Number: 2025,0,04,331512

ColdFusion (2025) Update 3 (release date, July 8, 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 10.1.42 and resolves several issues reported in earlier updates.

View the security bulletin, APSB25-69, for more information.

Type: Security

File: ColdFusion (2025 release) Update 3 (MD5: 41d73a0a6c28466d580e00e25182cb30)

Hotfix and packages repository: Link (MD5: e9bff6bdf4501c4e5a6e3d168d49d1e1)

Build Number: 2025,0,03,331507

ColdFusion (2025 release) Update 2 (release date, May 13, 2025) resolves critical and important vulnerabilities that could lead to arbitrary file system reads, arbitrary code execution, privilege escalation, and security feature bypass. It also addresses the PDFg service-related issues from the previous ColdFusion update.

View the security bulletin, APSB25-52, for more information.

Type: Security

File: ColdFusion (2025 release) Update 2 (MD5: 0d8a16dc614541a9cffde2b2261e97c7)

Hotfix and packages repository: Link (MD5: 8ecaf7a918a9ab808faa6777df3cc4de)

Build Number: 2025,0,02,331451

ColdFusion (2025 release) Update 1 (release date, April 8, 2025) resolves several critical vulnerabilities that could lead to arbitrary file system reading, arbitrary code execution, and security feature bypass.

View the security bulletin, APSB25-15, for more information.

Type: Security

File: ColdFusion (2025 release) Update 1 (MD5: d682df0a74302d7d01cbec24842999b7)

Hotfix and packages repository: Link (MD5: 1f325decf201f506eabbb2a904226733)

Build Number: 2025,0,01,331420