A maintenance release, not a security patch
Adobe released ColdFusion (2023 release) Update 25 on September 23, 2026. Unlike the coordinated Update 13/24 security patch covered in an earlier post, Adobe's own release notes for Update 25 don't list any CVEs, this is a routine maintenance release: dependency upgrades, bug fixes, and stability improvements rather than a vulnerability fix.
That said, Adobe still recommends applying the general security configuration settings on the ColdFusion Security page and reviewing the 2023 Lockdown Guide alongside any update, security hygiene isn't specific to security-labeled releases.
What's actually in it
31 OEM library upgrades
Significant version bumps across dependencies including Log4j (2.25.4), Jetty (9.4.58), Apache Maven (3.9.16), and several Apache Commons libraries, the kind of update that closes off whatever vulnerabilities were patched upstream in those libraries since the last release, even without a ColdFusion-specific CVE.
Query-of-Queries datatype and null-value fixes
Improved datatype handling and more consistent null-value behavior specifically for varchar columns, plus better preservation of column type metadata across query operations.
SFTP cipher negotiation fixes
Fixes two connection failures: cipher negotiation problems, and compatibility with older algorithms. Connecting to an older SFTP server needs two Java flags on the server: -Dcoldfusion.sftp.enable-ssh-rsa and -Dcoldfusion.sftp.enable-sha1-algorithms. Only add them if you need them, since they enable older, weaker algorithms.
17 bug fixes, including Administrator access for LDAP/AD groups
Notable ones: users who log in through AD/LDAP groups kept losing access to parts of the Administrator, now fixed, and an ObjectId handling fix for auto-generated MongoDB _id values.
Known issues in Update 25
Adobe documents four known issues in the Update 25 release notes. The first and second can stop ColdFusion from starting, so check these before you upgrade, or right after if ColdFusion won't start.
1. Sandbox Security startup failure (all platforms)
If Sandbox Security is enabled, ColdFusion may fail to start, and the Administrator shows 'Unable to install Security package' with a missing org/apache/commons/io/FileUtils class. Workaround: download commons-io.jar from the link in Adobe's notes (MD5 c28d562186a9571866673ce0980ccce4), copy it into the cfusion/lib folder under your ColdFusion root, and restart ColdFusion. Adobe says this will be fixed in an upcoming update.
2. Windows JVM startup failure
On Windows, ColdFusion may fail to start when certain Java agents or libraries are configured. We hit this on a Windows server running ColdFusion as a service with FusionReactor installed. The service failed to start with no clear error in the Windows or ColdFusion logs, and running the startup script from a command prompt showed 'Could not find agent library instrument on the library path'. Workaround: find the JDK set in jvm.config (java.home), add its bin folder as the first entry in the Windows System PATH, restart the machine, and start ColdFusion again.
3. XML DOCTYPE parsing errors
From Update 25, ALLOWDOCTYPEDECLARATION defaults to false. So xmlParse() and xmlValidate() reject XML that has a DOCTYPE, with the error 'DOCTYPE is disallowed when the feature ... disallow-doctype-decl is set to true'. Workaround: for trusted XML only, enable it explicitly in the options argument, as in the example below. Keep ALLOWEXTERNALENTITIES set to false.
xmlParse(
xmlContent,
false,
{
ALLOWDOCTYPEDECLARATION = true,
ALLOWEXTERNALENTITIES = false
}
);4. Missing Axis package
After installing the update and starting ColdFusion, the Axis package may be missing. Download it from the link in Adobe's notes.
Should you update?
Without a specific CVE driving it, this one fits a normal maintenance window rather than an urgent patch cycle. It's still worth prioritizing if your application actually touches one of the fixed areas specifically: Query-of-Queries against varchar columns, an SFTP integration hitting an older server, or LDAP/AD admin access.
The library upgrades (Log4j, Jetty, Apache Commons) are the part worth not deferring indefinitely, even without a ColdFusion-specific CVE attached, staying current on those dependencies is generally good practice on its own.