Resources

Latest from the ColdFusion Community Portal

NOW LIVE! ColdFusion 2025 and 2023 September 2026 security updates

NOW LIVE — the September 2026 security updates for ColdFusion 2025 and ColdFusion 2023 have been released. The updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure. What’s included The September 2026 release contains: SQL table and stored-procedure identifier validation New SQL validation opt-out flags XSLT collection() and uri-collection() blocked New XSLT compatibility flag AJAX widget HTML input sanitization guidance Configurable deserialization limits Package updates Download the updates ColdFusion […] Read More

Applications not working after installing Update 23 for ColdFusion 2023

application errors after installing Update 23 on a Windows 2019 server for ColdFusion 2023 Read More

Preparing Adobe ColdFusion Performance Monitoring Tool for Remote Monitoring

The Adobe ColdFusion Performance Monitoring Tool (PMT) provides a centralized way to monitor the health and performance of your ColdFusion instances. Adobe recommends deploying PMT on a dedicated server, allowing you to monitor one or more ColdFusion instances across your environment. By default, however, both the PMT and Datastore services are configured to bind to localhost (127.0.0.1). This may prevents remote ColdFusion instances from communicating with PMT. In this article, we’ll look at how to update the default network bindings and […] Read More

Troubleshooting ColdFusion Scheduled Tasks Failing Due to SSL Issues

Scheduled Tasks are commonly used in Adobe ColdFusion to automate background operations such as calling APIs, generating reports, sending emails, and synchronizing data. Occasionally, you may encounter a Scheduled Task that fails without providing enough information to identify the actual cause. One common scenario is when the Scheduled Task is configured to invoke an HTTPS URL, but the SSL handshake fails. Although the task reports a generic Connection Failure, the underlying exception isn’t immediately visible. This article walks through a […] Read More

Server.log filling up with message “http://apache.org/xml/features/disallow-doctype-decl”

Server.log filling up with message "http://apache.org/xml/features/disallow-doctype-decl" Read More

NOW LIVE! ColdFusion 2025 and 2023 August 2026 security updates

Adobe has released ColdFusion 2025 Update 12 and ColdFusion 2023 Update 23. The releases resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure. View the security bulletin, APSB26-90, for more information. Download the updates ColdFusion 2025 updates ColdFusion 2023 updates What’s new New JVM flag -Dcoldfusion.xml.saxon.allowCollection -Dcoldfusion.debugger.bindhost -Dcoldfusion.websocket.requireAuthForInvoke For more details, view: JVM arguments in CF 2025 JVM arguments in CF 2023 New Application.cfc flag this.wsRequireAuthForInvoke This flag controls whether […] Read More