Adobe patched both supported ColdFusion versions on the same day
On September 8, 2026, Adobe released ColdFusion (2025 release) Update 13 (build 2025.0.13.331960) and ColdFusion (2023 release) Update 24 (build 2023.0.24.330957), the same coordinated security patch applied to both currently supported versions.
Per the release notes, the update "resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure," tracked under Adobe's security bulletin APSB26-119.
What's actually in it
SQL injection prevention in cfgridupdate and cfstoredproc
Both tags now validate that table names and stored-procedure names are plain SQL identifiers (letters, digits, underscores, and schema dots) before using them in a query, closing off an injection path through those two tags specifically.
XSLT security hardening
XmlTransform() now blocks the collection() and uri-collection() XSLT functions, on top of the existing blocks on doc(), document(), and unparsed-text(), closing off another way a malicious stylesheet could read arbitrary files or reach internal systems.
Stricter AJAX widget sanitization
AJAX widgets rendering dynamic content now require developers to run it through GetSafeHTML() first, tightening the existing HTML-sanitization requirement.
Configurable deserialization limits
cfserialfilter.txt gains three new settings capping array length, nesting depth, and total element count during deserialization: a direct mitigation against maliciously crafted payloads designed to exhaust memory or the stack.
Version numbers, for reference
| ColdFusion version | Update | Build number |
|---|---|---|
| 2025 release | Update 13 | 2025.0.13.331960 |
| 2023 release | Update 24 | 2023.0.24.330957 |
Should you update?
Adobe's own language here ("critical" severity, "arbitrary code execution" among the listed impacts) is the kind of wording that normally means apply the patch promptly rather than waiting for a routine maintenance window, especially for anything internet-facing. If cfgridupdate or cfstoredproc build any part of a query from user-controllable input, or an app runs XmlTransform() against untrusted XSLT, those are the two areas worth checking first.
If you're learning ColdFusion rather than running it in production, the more useful takeaway is what these patches protect against in the first place: building SQL queries from unvalidated identifiers is exactly the class of mistake cfqueryparam and proper parameterization exist to prevent.
Sources
The primary sources for this post are Adobe's own release notes for both versions, plus the general ColdFusion security bulletin index: