A maintenance release, not a security patch
Adobe released ColdFusion (2023 release) Update 25 on September 23, 2026. Unlike the coordinated Update 13/24 security patch covered in an earlier post, Adobe's own release notes for Update 25 don't list any CVEs, this is a routine maintenance release: dependency upgrades, bug fixes, and stability improvements rather than a vulnerability fix.
That said, Adobe still recommends applying the general security configuration settings on the ColdFusion Security page and reviewing the 2023 Lockdown Guide alongside any update, security hygiene isn't specific to security-labeled releases.
What's actually in it
40+ OEM library upgrades
Significant version bumps across dependencies including Log4j (2.25.4), Jetty (9.4.58), Apache Maven (3.9.16), and several Apache Commons libraries, the kind of update that closes off whatever vulnerabilities were patched upstream in those libraries since the last release, even without a ColdFusion-specific CVE.
Query-of-Queries datatype and null-value fixes
Improved datatype handling and more consistent null-value behavior specifically for varchar columns, plus better preservation of column type metadata across query operations.
Spread operator fixes
Corrected issues with nested struct references when using the spread operator.
SFTP cipher negotiation fixes
Addresses cipher negotiation failures and adds legacy algorithm support for connecting to older SFTP servers, a real fix for anyone whose cfftp/SFTP integration talks to an older, less modern server.
27 total bug fixes across the Administrator, core runtime, database, Solr, and Scheduler
Notable ones: mail server connection persistence and LDAP/AD group authentication in the Administrator, remote function calls with query-string parameter rewrites, MongoDB ObjectID operation fixes, Solr basic-authentication collection access, and more accurate "Last Run" tracking in cfschedule.
Should you update?
Without a specific CVE driving it, this one fits a normal maintenance window rather than an urgent patch cycle. It's still worth prioritizing if your application actually touches one of the fixed areas specifically: Query-of-Queries against varchar columns, an SFTP integration hitting an older server, or cfschedule's "Last Run" tracking.
The library upgrades (Log4j, Jetty, Apache Commons) are the part worth not deferring indefinitely, even without a ColdFusion-specific CVE attached, staying current on those dependencies is generally good practice on its own.