We move your Lucee, ColdFusion or PHP application from classic hosting into containers without rewriting it. That lets you rebuild, update and relocate the environment. Security updates for PHP 8.2 end on 31 December 2026 (As of 2026-10).
Lucee: which versions still receive updates, with sources
Which Lucee versions still receive security updates? According to the Lucee project, Lucee 5.4 has reached its end of life, Lucee 6.2 is the long-term support branch and Lucee 7 the current stable line (As of 2026-10). The timeline gives the dates and the security advisories from the project's own publications, plus a checklist for operators.
- All dates with sources, as of 2026-10
- ColdFusion and Lucee in production since 2015
Published: 2026-10-26 · As of: 2026-10 · Editorial team Prownex
What the timeline shows and how to read it
The Lucee project states the status of its branches on the start page of its documentation rather than in a matrix with end dates. It runs one long-term support branch (LTS) next to the current stable line: according to the project, the LTS branch gets no new features, only critical bug fixes and regressions. Lucee 6.2 is that LTS branch, Lucee 7 the current stable line, and Lucee 5.4 reached its end of life on 31 December 2025; Lucee 5.3 and older are no longer supported either (As of 2026-10).
The timeline is ordered by date, and each row names one event and its source. A date in the past describes a state, not a shutdown date: the application keeps running, but newly discovered vulnerabilities get no patch.
The Lucee Administrator shows the version of your installation on its overview page. In code, it is in server.lucee.version. What Lucee is and how it differs from Adobe ColdFusion is explained in the article What is Lucee?.
Support dates and security advisories of Lucee
| Date | Event | Source |
|---|---|---|
| 2025-03-05 | The Lucee project publishes the advisory for CVE-2023-38693 (critical). According to the project it affects all earlier releases; it is patched in Lucee 5.4.3.2 and 5.3.12.1. | github.com (opens in a new window) |
| 2025-04-08 | The Lucee project publishes the advisory for CVE-2024-55354 (high). It is patched in Lucee 5.4.7.3 and 6.1.1.118; according to the project it mainly concerns shared and multi-tenant hosting. | github.com (opens in a new window) |
| 2025-11-03 | Lucee 7.0.0.395 is released as the stable 7.0 release. | dev.lucee.org (opens in a new window) |
| 2025-12-31 | Lucee 5.4 LTS: end of life. According to the project, no more security updates. | docs.lucee.org (opens in a new window) |
| 2026-02-18 | Roadmap 2026: Lucee 6.2 is the LTS branch with critical bug fixes only, Lucee 7.0 the current stable release; the next LTS is to be Lucee 7. | dev.lucee.org (opens in a new window) |
| 2026-10-05 | The Lucee project merges the fix for CVE-2026-29519 (reflected cross-site scripting in the error page) into the 7.1 line. Which release contains it is to be checked; the project has published no advisory. | github.com (opens in a new window) |
Lucee branches at a glance (As of 2026-10)
| Version | Status according to the Lucee project | What it means for operators |
|---|---|---|
| Lucee 5.3 and older | No longer supported | Upgrade to 6.2 LTS or Lucee 7. |
| Lucee 5.4 LTS | End of life since 31 December 2025 | No more security updates. An upgrade to 6.2 LTS or Lucee 7 is due. |
| Lucee 6.0 and 6.1 | Listed as older releases | The roadmap 2026 names only 6.2 LTS and Lucee 7 as current lines. Plan the move. |
| Lucee 6.2 LTS | Long-term support branch, no end announced; current release 6.2.9.4 | Critical bug fixes and regressions only, no new features. Supports javax and Jakarta servlets (Tomcat 10 and newer). |
| Lucee 7.0 | Stable since 3 November 2025, still receives fix releases | Jakarta servlets only (Tomcat 10 or newer); Java 11, 21 and 24. |
| Lucee 7.1 | Latest stable release, 7.1.0.204 | Java 25 as the baseline; mail sending (SMTP) moves into an extension, check it at every upgrade. The next LTS is to be Lucee 7. |
| Lucee 8.0 | Beta, not for production | The project's active development branch. |
What this means for operators
Once a branch no longer receives updates, newly discovered security vulnerabilities stay open. What that means for you depends on the version (As of 2026-10):
- Lucee 5.4 and older: There are no more security updates. An upgrade is needed; until then, the only option is to secure the surrounding environment.
- Lucee 6.0 and 6.1: The project lists them as older releases and names only 6.2 LTS and Lucee 7 as current lines. Plan the move.
- Lucee 6.2 LTS and Lucee 7: Both receive updates. The download page lists 6.2.9.4 as the current LTS release and 7.1.0.204 as the latest stable release.
The Lucee project publishes its security advisories in its GitHub repository. For CVE-2023-38693 and CVE-2024-55354 the fixes went into the releases named in the timeline. For CVE-2026-29519, the project merged a fix for the 7.1 line on 5 October 2026 and had published no advisory and no release note on it by the time of our check; until a release with the fix is installed, the error page can reflect parts of a crafted link.
What matters is a supported version, an Administrator that cannot be reached from the internet, and regular updates.
This is what you should check now:
- Which version is running, according to the Administrator or server.lucee.version?
- Is the Lucee Administrator reachable from the internet?
- Which Java version runs underneath, and does it match your target version? According to the project, Lucee 7.0 supports Java 11, 21 and 24; Lucee 7.1 takes Java 25 as its baseline.
- Does your application send mail through Lucee? From 7.1, mail sending is an extension.
- Is there a backup whose restore has been tested, and a test environment for the update?
More background is on the page ColdFusion & Lucee, including the move from Adobe ColdFusion.
How to proceed, depending on your starting point
-
-
Your legacy system works and holds rules nobody wants to rewrite. We expose its logic as a web service and close known vulnerabilities in a single pass. Comparison tests check whether behaviour stays the same, and the new system is built beside it in the new stack.
Have the installation checked: fixed scope, fixed price
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
Sources
The information comes from the following publications of the projects (as of 2026-10):
- Lucee documentation: start page (opens in a new window) for the status of Lucee 5.4, 6.2 and 7.
- Lucee documentation: system requirements (opens in a new window) for the Java and servlet requirements per version.
- Lucee downloads (opens in a new window) for the current LTS, stable and beta releases.
- Lucee Dev forum: Roadmap 2026 (opens in a new window) for the meaning of LTS and the plans for 7.1 and 8.0.
- Lucee security advisories on GitHub (opens in a new window) for CVE-2023-38693 and CVE-2024-55354.
- Lucee on GitHub: the fix for CVE-2026-29519 (opens in a new window).
Questions about Lucee versions and updates
Is my Lucee version still secure?
That depends on the branch. According to the Lucee project, Lucee 5.4 reached its end of life on 31 December 2025 and receives no more security updates; Lucee 6.2 is the long-term support branch and Lucee 7 the current stable line, and both receive updates (As of 2026-10). The project publishes its security advisories on GitHub: the fixes for CVE-2024-55354 went into Lucee 5.4.7.3 and 6.1.1.118, and for CVE-2026-29519 the project merged a fix for the 7.1 line in October 2026.
The setup matters just as much: a Lucee Administrator that cannot be reached from the internet, a current Java runtime and regularly applied updates. In the ColdFusion check we also assess Lucee installations and tell you whether an update is due. All dates with sources are in Lucee: end of support at a glance.
Who provides updates and support for Lucee?
Lucee is free and open source. The Lucee project publishes new releases; applying and securing them is up to you or a service provider.
We take over this maintenance on request: updates, securing the Lucee Administrator, monitoring and backups. We settle this before the migration, so that responsibility is clear after the switch.
Will our application run on Lucee unchanged?
That cannot be answered in general. Lucee implements CFML, but not every function behaves as it does in Adobe ColdFusion. Typical stumbling blocks are Adobe-specific tags and functions, and PDF output. Settings from the ColdFusion Administrator, such as data sources, scheduled tasks and mail sending, add to that.
Our engineers have migrated applications from Adobe ColdFusion to Lucee and build checks and tests into the plan from the start. The ColdFusion check assesses the installation; the code is checked in the legacy review or in the first phase of the migration. More on the page ColdFusion & Lucee.
Do you only know Adobe ColdFusion, or Lucee as well?
Both. Our engineers have worked continuously with ColdFusion and Lucee in production systems since 2015. That covers Adobe ColdFusion from version 9 to 2025 and Lucee 5, 6 and 7. We also work with ColdSpring, custom frameworks and migrations from Adobe ColdFusion to Lucee.
In 20 minutes we work out which first step fits your system
You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)