Adobe recently released ColdFusion (2025 release) Update 13 (build 2025.0.13.331960) and ColdFusion (2023 release) Update 24 (build 2023.0.24.330957) as a coordinated security update across both currently supported versions.
According to the release notes, this update resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure, tracked under security bulletin APSB26-119.
Key changes include:
SQL injection prevention — and now validate that table and procedure names are plain SQL identifiers before use.
XSLT security hardening — XmlTransform() now blocks the collection() and uri-collection() functions, in addition to the existing restrictions on doc() and document().
Stricter AJAX widget sanitization — dynamic content now requires GetSafeHTML() before rendering.
Configurable deserialization limits — cfserialfilter.txt now supports settings for maximum array length, nesting depth, and total element count.
If cfgridupdate or cfstoredproc build any part of a query from user-controllable input, or an app runs XmlTransform() against untrusted XSLT, those are the two areas worth checking first.
Full writeup with version numbers and sources: https://www.devlearningtools.com/blog/coldfusion-security-update-september-2026
Top comments (0)