Adobe ColdFusion August 2026 Priority 1 Security Update: What Production Teams Need to Patch and Test

Adobe released a Priority 1 security update for ColdFusion on August 11, 2026. The updates address multiple critical and important vulnerabilities, including an unauthenticated OS command-injection vulnerability with a CVSS score of 10.0.

If your organization runs Adobe ColdFusion 2025 or ColdFusion 2023 in production, this is not an update to leave in the normal maintenance queue. Adobe recommends installing Priority 1 updates as soon as possible, with 72 hours provided as an example timeframe.

Which ColdFusion versions are affected?

The updates apply to all supported platforms. Adobe has assigned both updates a Priority 1 rating.

Why this update is urgent

The most serious issue in Adobe security bulletin APSB26-90 is CVE-2026-48362, an OS command-injection vulnerability rated CVSS 10.0. Its published vector describes a network-accessible attack requiring no authentication and no user interaction, with potentially severe effects on confidentiality, integrity, and availability.

The bulletin also addresses additional vulnerabilities that could lead to arbitrary code execution, privilege escalation, security-feature bypass, application denial of service, and memory exposure.

Adobe states that it is not aware of exploitation in the wild at the time of publication. That is encouraging, but it does not lower the operational priority. Adobe reserves Priority 1 for vulnerabilities that are being targeted or have a higher risk of being targeted, and recommends installing these updates as soon as possible.

What changes beyond the vulnerability fixes?

These releases include security hardening and runtime changes that production teams should test before deployment.

WebSocket remote CFC calls now require authentication by default

ColdFusion now requires an authenticated WebSocket connection before it will process invoke or invokeAndPublish requests to CFC methods with access="remote". Applications using WebSocket-based CFC invocation should be tested specifically.

The behavior is controlled by this.wsRequireAuthForInvoke in Application.cfc or the JVM argument -Dcoldfusion.websocket.requireAuthForInvoke. The new default is true. Disabling the requirement restores the previous behavior, but doing so should be a deliberate, risk-reviewed decision rather than a reflexive compatibility fix.

Saxon collection access is denied by default

The new -Dcoldfusion.xml.saxon.allowCollection JVM setting defaults to false when unset. This blocks Saxon collection() and uri-collection() access to file and HTTP resources. Teams with specialized XML, XPath, or XSLT processing should include those workflows in regression testing.

Remote debugging now binds to loopback by default

The ColdFusion debugger now binds to 127.0.0.1 by default instead of all network interfaces. This is a sensible security improvement, but remote debugging workflows may require an explicit, carefully restricted configuration change.

CCS secrets are now installation-specific

The Central Configuration Server secret is now generated per installation using SecureRandom and tied to an environment fingerprint. Adobe notes that the key can regenerate when a system is cloned or restored from an image, remains stable across restarts on the same host, and is generated independently for each cluster node.

If your deployment process relies on machine images, cloning, restoration, clustering, or CCS-managed configuration, add CCS connectivity and configuration replication to the post-update test plan.

Tomcat and ColdFusion packages are updated

ColdFusion 2025 Update 12 includes Tomcat 10.1.57, while ColdFusion 2023 Update 23 includes Tomcat 9.0.120.0.

Both releases also update several ColdFusion packages. ColdFusion 2025 updates the Admin API, Administrator, AJAX, AI, debugger, PMT agent, and WebSocket packages. ColdFusion 2023 updates the same set except for the AI package. This is primarily a security release, not a new native AI feature release, but teams using ColdFusion AI functionality should still include those integrations in their smoke testing.

A practical production update checklist

Rollback planning requires extra attention

Adobe notes that uninstalling the core update does not necessarily return every ColdFusion package to its previous version. Packages whose minimum core dependency permits them to remain installed may stay at their latest compatible versions.

That means a reliable rollback plan should preserve the original installation and package state rather than assuming the built-in core uninstaller will reverse every part of the change.

Adobe says connector recreation is not required when moving from recent CF 2025 or CF 2023 updates to these releases. For ColdFusion 2023, however, Adobe notes that systems upgrading from Update 4 or earlier must recreate the web-server connector.

My recommendation

Treat this as an urgent, controlled production change:

• Begin testing immediately.
• Deploy within Adobe’s Priority 1 timeframe once validation succeeds.
• Do not perform an untested production update, particularly on clustered systems.
• Verify both the core build and package updates after installation.
• Keep a documented recovery path that accounts for package rollback behavior.

The CVSS 10.0 command-injection vulnerability makes delay risky. The behavior changes and reported cluster issue make disciplined testing equally important. The right approach is not to choose between speed and caution. It is to move quickly through a controlled, observable deployment process.

What Charlie Arehart Thinks

Charlie Arehart is a longtime ColdFusion server troubleshooter and consultant whose update analyses are widely followed within the CFML community. His detailed review of the August 11 updates adds useful field experience and operational context to Adobe’s documentation.

Charlie reports that the update process itself completed successfully for him across multiple machines, operating systems, ColdFusion releases, and starting update levels. That is encouraging for conventional, non-clustered installations, although he correctly notes that an update installing successfully does not guarantee that every application will behave correctly afterward.

His security assessment aligns with the recommendation here: the absence of known exploitation should not create a false sense of safety. Once a security update is public, vulnerabilities may be studied and reverse-engineered quickly. A Priority 1 update deserves prompt action.

Charlie also makes an especially important compatibility point. Several security changes in this release can be reversed through JVM or application settings. Those escape hatches may be necessary for a legitimate legacy requirement, but restoring the old behavior also gives back some of the protection the update introduced. Teams should understand the exposure and explore a secure application fix before enabling a compatibility override.

Finally, Charlie has personally reproduced the ColdFusion clustering failure described earlier, with reports involving both CF 2025 and CF 2023. His post documents the affected configuration, symptoms, relevant log error, community findings, and Adobe bug report. Administrators running Enterprise Manager instances in a ColdFusion cluster should read that section before scheduling production deployment.

His broader advice is also worth following after any ColdFusion update: check the update installation log, confirm that updated packages downloaded successfully, and inspect coldfusion-out.log to verify that package processing completed during startup. A green installation summary by itself is not the end of validation.

Read Charlie Arehart’s complete analysis

Official Adobe resources

• Adobe Security Bulletin APSB26-90
• ColdFusion 2025 Update 12 technical note
• ColdFusion 2023 Update 23 technical note
• Adobe’s August 2026 ColdFusion release announcement
• Adobe priority and severity ratings

This article reflects Adobe’s published guidance and reported update information available as of August 24, 2026. Review the linked technical notes and security bulletin for subsequent changes before updating production systems.

Need help planning or validating a ColdFusion update? hale.group helps organizations modernize, secure, and support business-critical CFML applications. Contact us to discuss your environment.

---

About the Author

Dusty Hale

I’m a professional full stack web application developer having worked in multiple application stacks for 28+ years, since 1998. My career began in Atlanta, GA, where I worked as a developer with Kaplan Communications, Spun Logic, and b2bTech. In current times, I am the project director for hale.group. I live in Tamarindo, Costa Rica and work remotely from a dedicated work space.

---