According to Adobe, ColdFusion 2021 has received no security patches since 10 November 2025. We compare four routes: stay and harden, update, move to Lucee or replace the system step by step, with dates and risks (As of 2026-10).
Adobe ColdFusion: end of support by version, with sources
Which Adobe ColdFusion versions still receive security updates? The timeline gives the dates for ColdFusion 2018 to 2025 from Adobe's own publications (As of 2026-10). It also covers the security position and a checklist for operators.
- All dates with sources, as of 2026-10
- ColdFusion and Lucee in production since 2015
Published: 2026-10-26 · As of: 2026-10 · Editorial team Prownex
What the timeline shows and how to read it
Adobe gives each ColdFusion version five years of core support. Up to ColdFusion 2023, one further year of extended support follows; for ColdFusion 2025, Adobe lists none. According to Adobe, extended support is best-effort help with the migration and includes no security patches or hotfixes (As of 2026-10). For ColdFusion 2021, core support ended on 10 November 2025, and extended support ends on 10 November 2026. ColdFusion 2018 and older no longer have core support; ColdFusion 2023 and 2025 are still maintained.
The timeline is ordered by date, and each row names one version and its source. A date in the past describes a state, not a shutdown date: the application keeps running, but newly discovered vulnerabilities get no patch.
The ColdFusion Administrator shows the version of your installation under System Information. In code, it is in server.coldfusion.productversion.
Lucee has its own overview: Lucee: end of support at a glance. The article What is Lucee? explains what Lucee is.
Support dates of Adobe ColdFusion
| Date | Event | Source |
|---|---|---|
| 2023-07-13 | Adobe ColdFusion 2018: end of core support. | helpx.adobe.com (opens in a new window) |
| 2025-11-10 | Adobe ColdFusion 2021: end of core support. | helpx.adobe.com (opens in a new window) |
| 2026-06-30 | Adobe publishes security bulletin APSB26-68 with priority 1, including CVE-2026-48282. Updates exist only for ColdFusion 2025 (Update 10) and ColdFusion 2023 (Update 21). | helpx.adobe.com (opens in a new window) |
| 2026-11-10 | Adobe ColdFusion 2021: end of extended support. According to Adobe, it includes no security patches or hotfixes. | coldfusion.adobe.com (opens in a new window) |
| 2028-05-16 | Adobe ColdFusion 2023: end of core support. | helpx.adobe.com (opens in a new window) |
| 2030-02-26 | Adobe ColdFusion 2025: end of core support. Adobe lists no extended support for this version. | helpx.adobe.com (opens in a new window) |
What end of support means for operators
Once support has ended, newly discovered security vulnerabilities stay open. What that means for you depends on the version (As of 2026-10):
- ColdFusion 2018 and older: There are no more security patches. An update or migration is needed; until then, the only option is to secure the surrounding environment.
- ColdFusion 2021: According to Adobe, extended support includes no security patches and is limited to 10 November 2026. Anyone who keeps running this version needs a plan for the time after that.
- ColdFusion 2023 and 2025: Both receive security updates.
For CVE-2026-48282, Adobe has published updates only for ColdFusion 2025 and 2023 (bulletin APSB26-68, priority 1). According to Adobe, the vulnerability has been exploited in limited attacks. The vulnerabilities in the bulletin can lead to arbitrary code execution, privilege escalation, reading arbitrary files and bypassing security features.
What matters is a supported version, an Administrator that cannot be reached from the internet, and regular updates.
This is what you should check now:
- Which version and patch level is running, according to the Administrator under System Information?
- Are the Administrator and RDS (the remote access for development tools) reachable from the internet?
- Which Java version runs underneath, and does it support your target version?
- Is there a backup whose restore has been tested, and a test environment for the update?
More background is on the page ColdFusion & Lucee.
How to proceed, depending on your starting point
-
-
Your legacy system works and holds rules nobody wants to rewrite. We expose its logic as a web service and close known vulnerabilities in a single pass. Comparison tests check whether behaviour stays the same, and the new system is built beside it in the new stack.
Have the installation checked: fixed scope, fixed price
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
Sources
The information comes from the following publications of the projects (as of 2026-10):
- Adobe: ColdFusion EOL matrix (opens in a new window) for the dates of ColdFusion 2018, 2021, 2023 and 2025.
- Adobe ColdFusion Blog: post on the end of support for ColdFusion 2021 (opens in a new window) of 5 March 2026 for extended support.
- Adobe: security bulletin APSB26-68 (opens in a new window) for the patches for CVE-2026-48282.
A case from our work
-
ColdFusion 2025 in production behind Apache: five traps that are not obvious
We prepared a production installation of Adobe ColdFusion 2025 on Debian 12, behind an Apache 2.4 that already serves several other sites. The installation itself takes 34 seconds. The attention went into the connector and the configuration details that are easy to miss: an error 503 caused by IPv6, mappings that reach into every virtual host, and a profile that quietly adds a debugger.
Questions on end of support for ColdFusion and Lucee
Can we simply keep running ColdFusion 2021?
Technically yes, the application keeps running. According to Adobe's end-of-support announcement (opens in a new window), ColdFusion 2021 has had no security patches since 10 November 2025, and extended support runs only until 10 November 2026 (As of 2026-10). How high the risk is depends on whether the application and the administrator can be reached from the internet.
As a stopgap, carrying on is defensible while the switch is being prepared. That means blocking access to the administrator and RDS, placing a WAF with rules for your application in front, and segmenting the network. That lowers the risk but does not remove it. We do not recommend it as a long-term arrangement, because auditors, insurers and customers often ask about supported versions.
Is my ColdFusion version still secure?
It depends on which version you run. ColdFusion 2025 and 2023 receive security updates; according to Adobe, ColdFusion 2021 and older versions no longer receive security patches (As of 2026-10). For CVE-2026-48282, which according to Adobe has been exploited in limited attacks, Adobe has published updates only for ColdFusion 2025 and 2023 (bulletin APSB26-68).
Besides the version, what matters is an administrator that cannot be reached from the internet, and regular updates. In the ColdFusion check we assess your installation.
Who provides updates and support for Lucee?
Lucee is free and open source. The Lucee project publishes new releases; applying and securing them is up to you or a service provider.
We take over this maintenance on request: updates, securing the Lucee Administrator, monitoring and backups. We settle this before the migration, so that responsibility is clear after the switch.
How much work is the update to ColdFusion 2023 or 2025?
Most of it depends on the code: whether, and how far, it runs on the new version. Between ColdFusion versions some functions and tags change their behaviour or disappear, and then the code has to be reworked. The hardest case is an application built on a framework that no longer receives updates and does not support the new version: adapting or replacing the framework then becomes part of the work. On top of that come custom Java libraries and the settings at the Java and Tomcat level. The same applies to an update of Lucee.
Starting from ColdFusion 2021, the possible targets are 2023 (core support until 16 May 2028) and 2025 (until 26 February 2030, according to Adobe's matrix). On top of that come the licence, testing and moving the settings across. We give you the number of working days for your case after the ColdFusion check.
In 20 minutes we work out which first step fits your system
You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)