According to Adobe, ColdFusion 2021 has received no security patches since 10 November 2025. We compare four routes: stay and harden, update, move to Lucee or replace the system step by step, with dates and risks (As of 2026-10).
ColdFusion and Lucee: maintenance, updates and migration
Our engineers have run Adobe ColdFusion and Lucee in production continuously since 2015, even when documentation and author are missing.
- ColdFusion and Lucee experience in production since 2015
- Adobe ColdFusion 9 to 2025
- Lucee 5, 6 and 7
Where we use ColdFusion and Lucee
Our engineers look after ColdFusion and Lucee applications that have been in production for years. Often these are long-running business applications whose developer has left and whose documentation is missing.
Their experience ranges from Adobe ColdFusion 9 to 2025 and from Lucee 5 to 7. They know ColdSpring and in-house frameworks, have moved applications from Windows and IIS to Linux and have migrated applications from Adobe ColdFusion to Lucee. The kinds of systems involved are described on the Experience page. What Lucee is and how it differs from Adobe ColdFusion is explained in the article What is Lucee?.
Typical tasks with ColdFusion and Lucee
- Emergency takeover when the developer has left and the system has to keep running.
- Check of the installation: Administrator and RDS, JVM, TLS, backups, scheduled tasks and outgoing email via cfmail.
- Update from Adobe ColdFusion 2018 or 2021 to 2023 or 2025.
- Migration from Adobe ColdFusion to Lucee, with tests and a fallback plan.
- Move from Windows and IIS to Linux with Docker, including a test of the PDF output.
- Ongoing maintenance: Adobe updates, JVM, monitoring and backups.
- Gradual modernisation: expose proven logic as an API and build new functionality alongside it (Use the monolith as a web service).
- Knowledge transfer, documentation and code review for CFML.
Which version are you running?
Adobe provides five years of core support for each ColdFusion version, followed by one year of extended support up to ColdFusion 2023. According to Adobe (opens in a new window), extended support is best-effort help with the migration and includes no security patches or hotfixes (As of 2026-10). For ColdFusion 2025, Adobe lists no extended support.
Support dates for Adobe ColdFusion
| Date | Event | Source |
|---|---|---|
| 2023-07-13 | Adobe ColdFusion 2018: end of core support. | helpx.adobe.com (opens in a new window) |
| 2025-11-10 | Adobe ColdFusion 2021: end of core support. | helpx.adobe.com (opens in a new window) |
| 2026-11-10 | Adobe ColdFusion 2021: end of extended support. | helpx.adobe.com (opens in a new window) |
| 2028-05-16 | Adobe ColdFusion 2023: end of core support. | helpx.adobe.com (opens in a new window) |
| 2030-02-26 | Adobe ColdFusion 2025: end of core support. Adobe lists no extended support for this version. | helpx.adobe.com (opens in a new window) |
Which Lucee versions are still supported (As of 2026-10)
| Version | Status according to the Lucee project | What this means for you |
|---|---|---|
| Lucee 5.4 and older | 5.4: end of life since 31 December 2025; 5.3 and older no longer supported | No more security updates. An upgrade to 6.2 LTS or Lucee 7 is due. |
| Lucee 6.0 and 6.1 | Listed as older releases | The roadmap 2026 names only 6.2 LTS and Lucee 7 as current lines. Plan the move. |
| Lucee 6.2 LTS | Long-term support branch, no end announced | Critical bug fixes and regressions only, no new features. |
| Lucee 7.0 and 7.1 | 7.0 stable since 3 November 2025; 7.1.0.204 the latest stable release | Both receive updates. Lucee 7.1 moves mail sending (SMTP) into an extension, check it at every upgrade. The next LTS is to be Lucee 7. |
| Lucee 8.0 | Beta, not for production | The project's active development branch. |
What is the security situation?
The most important vulnerability right now is CVE-2026-48282 (As of 2026-10). Adobe published security bulletin APSB26-68 for it on 30 June 2026, with priority 1. Updates exist only for ColdFusion 2025 (Update 10) and ColdFusion 2023 (Update 21). Affected are ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier.
Adobe states that it is aware of CVE-2026-48282 being exploited in limited attacks. According to the bulletin, the vulnerabilities can lead to arbitrary code execution, privilege escalation, reading arbitrary files and bypassing security features. The bulletin contains no update for ColdFusion 2021.
For Lucee too, what matters is a supported version, an Administrator with no access from the internet and regular updates. All Lucee dates and the project's security advisories with sources: Lucee: end of support at a glance.
CVE-2026-48282 over time
| Date | Event | Source |
|---|---|---|
| 2026-06-30 | Adobe publishes security bulletin APSB26-68 with priority 1. Updates exist only for ColdFusion 2025 (Update 10) and ColdFusion 2023 (Update 21). | helpx.adobe.com (opens in a new window) |
What can change in PDFs and file paths after a move from Windows to Linux
When ColdFusion moves from Windows and IIS to Linux, the fonts and page sizes of generated documents often change. Page breaks, tables and footers shift as a result. It is easy to notice this only after going live.
File paths are a second common problem. Windows works with drive letters and backslashes, such as C:\inetpub\wwwroot, Linux with a single directory tree and forward slashes, such as /var/www. Paths written into the code, the configuration or the database, for example to images and fonts in PDFs or to upload folders, no longer fit after the move. Linux also distinguishes upper and lower case in file names. We have moved applications like these before and know where such paths are hidden.
Our migration plans therefore include a dedicated test. We compare documents before and after the move, check installed fonts, page formats and file paths, and correct deviations before the switch goes live.
Technologies and scope
| Area | Scope |
|---|---|
| Runtime | Adobe ColdFusion 9 to 2025, Lucee 5, 6 and 7 |
| Architecture | ColdSpring, in-house frameworks |
| Migrations | Windows and IIS to Linux, Adobe ColdFusion to Lucee, carried out in projects |
| Documents | PDF generation from CFML, behaviour after a platform change |
| Containers and API | Docker for Lucee and Adobe ColdFusion, exposing CFML logic as a REST or SOAP API and securing it as a one-off task |
| Databases and servers | MySQL and MariaDB with Galera, Linux, TLS, KVM and Proxmox |
Typical starting points with ColdFusion and Lucee
-
-
Your developer has resigned or already left, and the system has to keep running. We review the system and give you a written report 48 hours after access: its state, the immediate risks and a plan for the first 30 days.
-
Your team is at capacity, a specific skill is missing, or you need a second opinion before an important decision? We take over a defined part: a module, the backend for your frontend, an interface, a migration or a code review. We work in your repository and ticket system, and the code and the knowledge stay with you.
The first step with a fixed scope and a fixed price
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
48-hour emergency assessment
For companies whose developer or service provider has suddenly left and whose system has to keep running regardless.
- Inventory: versions, dependencies, access, backups, scheduled tasks, data sources and outgoing email
- List of the risks that need attention immediately
- Stabilisation plan for the first 5 days and for the first 30 days
- Short meeting to go through the results
The result is with you 48 hours after we have access to the system. Changes to the production system and any further work happen only with your approval.
What the result contains
A written report on the state of the system, the immediate risks and the stabilisation plan. The report is yours.
Projects with ColdFusion
-
ColdFusion 2025 in production behind Apache: five traps that are not obvious
We prepared a production installation of Adobe ColdFusion 2025 on Debian 12, behind an Apache 2.4 that already serves several other sites. The installation itself takes 34 seconds. The attention went into the connector and the configuration details that are easy to miss: an error 503 caused by IPv6, mappings that reach into every virtual host, and a profile that quietly adds a debugger.
-
ColdFusion under load: diagnosing and fixing the JVM heap space error
An Adobe ColdFusion application ran without complaint at low traffic and returned errors and slowed down at peak hours. We reproduced the problem on a real database, measured the exact point at which the JVM heap runs out, and fixed the memory configuration, with the same load test before and after as the proof.
Questions about ColdFusion and Lucee
Do you only know Adobe ColdFusion, or Lucee as well?
Both. Our engineers have worked continuously with ColdFusion and Lucee in production systems since 2015. That covers Adobe ColdFusion from version 9 to 2025 and Lucee 5, 6 and 7. We also work with ColdSpring, custom frameworks and migrations from Adobe ColdFusion to Lucee.
Is my ColdFusion version still secure?
It depends on which version you run. ColdFusion 2025 and 2023 receive security updates; according to Adobe, ColdFusion 2021 and older versions no longer receive security patches (As of 2026-10). For CVE-2026-48282, which according to Adobe has been exploited in limited attacks, Adobe has published updates only for ColdFusion 2025 and 2023 (bulletin APSB26-68).
Besides the version, what matters is an administrator that cannot be reached from the internet, and regular updates. In the ColdFusion check we assess your installation.
Is my Lucee version still secure?
That depends on the branch. According to the Lucee project, Lucee 5.4 reached its end of life on 31 December 2025 and receives no more security updates; Lucee 6.2 is the long-term support branch and Lucee 7 the current stable line, and both receive updates (As of 2026-10). The project publishes its security advisories on GitHub: the fixes for CVE-2024-55354 went into Lucee 5.4.7.3 and 6.1.1.118, and for CVE-2026-29519 the project merged a fix for the 7.1 line in October 2026.
The setup matters just as much: a Lucee Administrator that cannot be reached from the internet, a current Java runtime and regularly applied updates. In the ColdFusion check we also assess Lucee installations and tell you whether an update is due. All dates with sources are in Lucee: end of support at a glance.
Can we simply keep running ColdFusion 2021?
Technically yes, the application keeps running. According to Adobe's end-of-support announcement (opens in a new window), ColdFusion 2021 has had no security patches since 10 November 2025, and extended support runs only until 10 November 2026 (As of 2026-10). How high the risk is depends on whether the application and the administrator can be reached from the internet.
As a stopgap, carrying on is defensible while the switch is being prepared. That means blocking access to the administrator and RDS, placing a WAF with rules for your application in front, and segmenting the network. That lowers the risk but does not remove it. We do not recommend it as a long-term arrangement, because auditors, insurers and customers often ask about supported versions.
Will our application run on Lucee unchanged?
That cannot be answered in general. Lucee implements CFML, but not every function behaves as it does in Adobe ColdFusion. Typical stumbling blocks are Adobe-specific tags and functions, and PDF output. Settings from the ColdFusion Administrator, such as data sources, scheduled tasks and mail sending, add to that.
Our engineers have migrated applications from Adobe ColdFusion to Lucee and build checks and tests into the plan from the start. The ColdFusion check assesses the installation; the code is checked in the legacy review or in the first phase of the migration. More on the page ColdFusion & Lucee.
How much work is the update to ColdFusion 2023 or 2025?
Most of it depends on the code: whether, and how far, it runs on the new version. Between ColdFusion versions some functions and tags change their behaviour or disappear, and then the code has to be reworked. The hardest case is an application built on a framework that no longer receives updates and does not support the new version: adapting or replacing the framework then becomes part of the work. On top of that come custom Java libraries and the settings at the Java and Tomcat level. The same applies to an update of Lucee.
Starting from ColdFusion 2021, the possible targets are 2023 (core support until 16 May 2028) and 2025 (until 26 February 2030, according to Adobe's matrix). On top of that come the licence, testing and moving the settings across. We give you the number of working days for your case after the ColdFusion check.
Do we have to rewrite our system to use a new stack?
No. If the old system is running, we expose its logic as an API and close known security gaps as a one-off step. Its behaviour is meant to stay unchanged, and comparison tests check that. We then build the new part alongside it in the new stack, and it uses that API.
A rewrite is rarely worthwhile. It becomes an option when the framework is no longer maintained, there are no tests and the business rules can be written down. The legacy review clarifies whether that applies to you.
Which projects have you already delivered?
Our engineers have worked on these types of system:
- Loan processing platforms, including work directly for banks
- Platforms for mortgage financing
- Leasing platforms
- Systems that generate documents and contracts
- Video portals with streaming and automated video conversion
- High-traffic news and classifieds portals
- Web services of companies that work for the public sector, including cultural institutions
Selected projects are described in detail on the projects page, among them ColdFusion in production and under load, email deliverability, a shop flooded by bots and SQL indexes in a shop database.
Not sure which service fits your system?
Describe your system in two sentences. We will tell you which service fits and whether an entry product at a fixed price is the right first step.