+48 501 250 220

ColdFusion 2021 without security patches: your options

According to Adobe, ColdFusion 2021 has received no security patches since 10 November 2025. We compare four routes: stay and harden, update, move to Lucee or replace the system step by step, with dates and risks (As of 2026-10).

Have your ColdFusion installation checked ColdFusion and Lucee at a glance
  • ColdFusion and Lucee in production since 2015
  • Adobe ColdFusion 9 to 2025, Lucee 5, 6 and 7
  • Reply within one working day
A stack of four layers, the second one hatched, with lines to three small boxes on its right; a thin line from the hatched layer leads down to an orange tick on a timeline, and an arrow from the stack points to a later tick

Is your ColdFusion version still supported?

The ColdFusion Administrator shows the version under System Information. In code, you can read it from the variable server.coldfusion.productversion. Whether it is still supported depends on the release year (As of 2026-10):

  • ColdFusion 2018 and older: Core support ended on 13 July 2023 at the latest. Since then there have been no security patches.
  • ColdFusion 2021: Core support ended on 10 November 2025. The year of extended support that follows runs until 10 November 2026. According to Adobe's notice on the end of support (opens in a new window), extended support includes no security patches or hotfixes.
  • ColdFusion 2023 and 2025: Both receive security updates.

After support ends, the application keeps running, but newly discovered vulnerabilities no longer get a patch.

A server joined by a line to a wall calendar; one day in the calendar grid is marked orange

When does support end for which version?

As of: 2026-10
Date Event Source
2023-07-13 Adobe ColdFusion 2018: end of core support. helpx.adobe.com (opens in a new window)
2025-11-10 Adobe ColdFusion 2021: end of core support. helpx.adobe.com (opens in a new window)
2026-11-10 Adobe ColdFusion 2021: end of extended support. helpx.adobe.com (opens in a new window)
2028-05-16 Adobe ColdFusion 2023: end of core support. helpx.adobe.com (opens in a new window)
2030-02-26 Adobe ColdFusion 2025: end of core support. Adobe lists no extended support for this version. helpx.adobe.com (opens in a new window)

What the security situation means for ColdFusion 2021

One vulnerability that matters right now is CVE-2026-48282 (As of 2026-10). Adobe published security bulletin APSB26-68 on 30 June 2026 with priority 1. It contains updates only for ColdFusion 2025 (Update 10) and ColdFusion 2023 (Update 21), and none for ColdFusion 2021.

According to Adobe, CVE-2026-48282 has been exploited in limited attacks. The vulnerabilities in the bulletin can lead to arbitrary code execution, privilege escalation, reading arbitrary files and bypassing security features.

For Lucee too, what matters is a supported version, an Administrator that cannot be reached from the internet, and regular updates. The page ColdFusion & Lucee summarises the security situation.

A server above a time line: up to the orange line, the end of support, updates arrive as filled dots; after it the line is dashed and open rings for unfixed vulnerabilities pile up

Which option fits which starting point? (As of 2026-10)

Criterion Stay and harden Update to ColdFusion 2023 or 2025 Move to Lucee Replace step by step
What happens The installation stays as it is. Administrator and RDS (remote access for development tools) are reachable internally only. A WAF with rules for your application filters traffic, and we segment the network into zones. The application runs on a supported Adobe version. We test it on the new version before the switch. The application runs on a current Lucee version. We check and test Adobe-specific functions, PDF output and the settings from the Administrator. We make proven logic available as an API and harden it once. New functions are built alongside it in a current stack. We replace the old parts where it pays off.
Security patches None for ColdFusion 2021 and older. The measures reduce the risk but do not remove the vulnerabilities. Yes, ColdFusion 2023 and 2025 receive security updates. Yes, for supported versions. Depends on the runtime the legacy system keeps running on in the interim.
Fits when a switch is already firmly planned and you need to bridge the time until then. We do not recommend this as a permanent state. you want to stay with Adobe and the application fits the new environment. you want to move to an open-source runtime and the application uses no Adobe-specific features. the business logic is valuable, nobody wants to rewrite it, and a new stack should make use of its functions.

What we cannot say without seeing your system

Blanket statements about the effort and duration of a migration are not credible without looking at the application. Whether your code runs unchanged on Lucee, how long an update takes and what it costs all depend on your installation. We name a figure only once we have seen the installation.

BoxLang is another CFML-compatible runtime. Our practice is with Adobe ColdFusion and Lucee, so BoxLang is not in the table.

The routes in detail are on the pages ColdFusion & Lucee, Use the monolith as a web service and Migration and modernisation. What Lucee is and how it differs from Adobe ColdFusion is explained in the article What is Lucee?. If you want to stay and harden for a while, we discuss the measures in a call; they are described under Linux operations and infrastructure.

On the left a dashed server, a system not yet reviewed; above, a wide dashed range for an estimate made without looking at the system; an arrow leads to a short orange range, the estimate after the review

From the intro call to a written basis for your decision

  1. Intro call

    You describe the version, server and deadline. You receive a first reply within one working day.

  2. Access

    You decide which access credentials to grant and can revoke them after the check.

  3. Review

    Two to three working days from access. We check the version, the patch level and whether the Administrator and RDS are reachable. We also look at the JVM, Tomcat, TLS, backups, scheduled tasks, data sources and email sending with cfmail.

  4. Written findings

    You receive the findings in order of priority, the options for the platform and a recommendation. The findings belong to you.

  5. Decision

    We then estimate the effort of the chosen option separately, before you commission anything. The decision stays with you.

What our engineers' assessment is based on

Operations
ColdFusion and Lucee in production since 2015
Versions
Adobe ColdFusion 9 to 2025 and Lucee 5, 6 and 7
Migrations
From Adobe ColdFusion to Lucee and from Windows and IIS to Linux, including PDF output testing
Types of systems
Platforms for loan processing, mortgage financing and leasing, and systems that generate documents and contracts.

Code, passwords and documentation stay with you

  • If we stop working together, we hand over results and documentation in an orderly way to you or your next provider.
  • We also tell you when a switch is not worth it.

And if someone on our side drops out? We write the documentation on request. The repository is normally with you. We arrange cover on request. More under How we work and Experience.

On the right an orange frame holding the source code, an access card and the documentation; on the left an administrator at a laptop, joined to the frame only by a dashed line

The first step: a check with a fixed scope and a fixed price

ColdFusion check

For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.

  • Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
  • Reachability of the Administrator and RDS
  • JVM, Tomcat and TLS
  • Backups, scheduled tasks, data sources and outgoing email via cfmail
  • Options for the platform: stay on current patches, upgrade the version or migrate to Lucee

The check does not cover application logic or code. That is what the legacy review is for.

What the result contains

A written list of findings in order of priority, with the options and a recommendation. The list is yours.

from €2,400 excl. VAT

Typically 3 working days

Have your ColdFusion installation checked

Two cases from our work

  • A browser, a box labelled Apache and three lanes to PHP, PHP and CFML; the CFML lane and box are orange

    ColdFusion 2025 in production behind Apache: five traps that are not obvious

    We prepared a production installation of Adobe ColdFusion 2025 on Debian 12, behind an Apache 2.4 that already serves several other sites. The installation itself takes 34 seconds. The attention went into the connector and the configuration details that are easy to miss: an error 503 caused by IPv6, mappings that reach into every virtual host, and a profile that quietly adds a debugger.

  • A large empty frame labelled RAM 40 GB with a small frame labelled JVM 1 GB inside, full of blocks, orange blocks spilling over its top

    ColdFusion under load: diagnosing and fixing the JVM heap space error

    An Adobe ColdFusion application ran without complaint at low traffic and returned errors and slowed down at peak hours. We reproduced the problem on a real database, measured the exact point at which the JVM heap runs out, and fixed the memory configuration, with the same load test before and after as the proof.

Questions that come up before you decide

Can we simply keep running ColdFusion 2021?

Technically yes, the application keeps running. According to Adobe's end-of-support announcement (opens in a new window), ColdFusion 2021 has had no security patches since 10 November 2025, and extended support runs only until 10 November 2026 (As of 2026-10). How high the risk is depends on whether the application and the administrator can be reached from the internet.

As a stopgap, carrying on is defensible while the switch is being prepared. That means blocking access to the administrator and RDS, placing a WAF with rules for your application in front, and segmenting the network. That lowers the risk but does not remove it. We do not recommend it as a long-term arrangement, because auditors, insurers and customers often ask about supported versions.

Is a WAF enough?

Not on its own. A web application firewall (WAF) filters typical attacks in front of the application and buys time. It does not close a vulnerability in the code. That is why we combine it with fixing known vulnerabilities, network segmentation and administrator access through a VPN only.

A WAF with rules written for your application triggers fewer false alarms and protects better in practice than the default configuration. If the code cannot be changed quickly, a WAF with isolation is a stop-gap until the update. The risk then falls but does not disappear.

How much work is the update to ColdFusion 2023 or 2025?

Most of it depends on the code: whether, and how far, it runs on the new version. Between ColdFusion versions some functions and tags change their behaviour or disappear, and then the code has to be reworked. The hardest case is an application built on a framework that no longer receives updates and does not support the new version: adapting or replacing the framework then becomes part of the work. On top of that come custom Java libraries and the settings at the Java and Tomcat level. The same applies to an update of Lucee.

Starting from ColdFusion 2021, the possible targets are 2023 (core support until 16 May 2028) and 2025 (until 26 February 2030, according to Adobe's matrix). On top of that come the licence, testing and moving the settings across. We give you the number of working days for your case after the ColdFusion check.

Will our application run on Lucee unchanged?

That cannot be answered in general. Lucee implements CFML, but not every function behaves as it does in Adobe ColdFusion. Typical stumbling blocks are Adobe-specific tags and functions, and PDF output. Settings from the ColdFusion Administrator, such as data sources, scheduled tasks and mail sending, add to that.

Our engineers have migrated applications from Adobe ColdFusion to Lucee and build checks and tests into the plan from the start. The ColdFusion check assesses the installation; the code is checked in the legacy review or in the first phase of the migration. More on the page ColdFusion & Lucee.

Do we have to rewrite our system to use a new stack?

No. If the old system is running, we expose its logic as an API and close known security gaps as a one-off step. Its behaviour is meant to stay unchanged, and comparison tests check that. We then build the new part alongside it in the new stack, and it uses that API.

A rewrite is rarely worthwhile. It becomes an option when the framework is no longer maintained, there are no tests and the business rules can be written down. The legacy review clarifies whether that applies to you.

When can you start?

You will receive a first reply within one working day. When we begin work depends on our current workload and on the scope. We give you a binding answer in the intro call. If it is urgent, the 48-hour emergency assessment starts as soon as we have access to the system.

Tell us your version, server and deadline

A few sentences are enough to start. We reply within one working day.

Fields marked optional can stay empty.

Reply by email

For a call back we only need your phone number: emergencies around the clock, otherwise within one working day.

Which system, which technology, what do you want to achieve? Please do not send passwords or confidential documents.

Reply within one working day · without obligation

We use your details only to answer your enquiry. Prownex IT Services Sp. z o. o. is the controller. Retention and your rights are described in the privacy policy.