TL;DR: Update 11 (and possibly 8 and 10) installer has an issue where it backs up and deletes cfusion/jetty/lib but never actually re-installs the new version into place, silently killing the ColdFusion Add-on Services (PDFg, Solr, Remote Admin).

The symptom:

After running the hotfix update, the **ColdFusion 2025 Add-on Services** Windows service fails to start. Event Viewer shows generic errors like:

- Service error **1067**: *"The process terminated unexpectedly."

We first noticed this starting with HF8, and it was still present in HF11.

Root cause (confirmed via install log):

Pulled the actual Adobe_ColdFusion_2025_Update_11_Install_*.log and traced the sequence of operations on cfusion/jetty/lib:

1. Installer extracts the *new* jetty payload (jetty 9.4.58, log4j 2.25.4, etc.) into a temp folder:
   C:\Users<user>\AppData\Local\Temp<random>.tmp\dist\cfusion\jetty\lib...

2. It then backs up the **live** `jetty\lib` folder:
   Delete: C:\ColdFusion2025\cfusion/jetty/lib
Move Directory:
Source: ...\cfusion\jetty\lib
Destination: ...\hf-updates\hf-2025-00011-<id>\backup/jetty/lib

3. It then deletes its own temp extraction folder without ever copying those new files into the live location:
   Delete: C:\Users<user>\AppData\Local\Temp<random>.tmp\dist\cfusion\jetty

Every other component in the update (bin, other lib jars, wwwroot, etc.) gets a proper backup-then-copy pair in the log. jetty/lib only gets the backup half. The "install the new version" step is just missing. Result: the folder is empty/gone after the update finishes, and the add-on services - which run out of the embedded Jetty container - have nothing to load.

Why restoring from the hf-updates backup isn't the right fix:
Doing that just gives you back whatever jetty/lib you had before this update - not the actual Update 11 build. If this bug has been present since Update 8 (it has, for us), anyone "fixing" it via backup restore on 8, 9, 10 has been running increasingly stale jetty builds the whole time. That also explains why some servers' jetty/lib differs from others depending on when they last had a working install.

The actual fix:
Since the installer deletes its temp extraction before you can grab it, pull the real files from the hotfix installer package itself:

1. Find the hotfix installer files, typically under:
   C:\ColdFusion2025\bundles\updateinstallers\hotfix-011-<id>\

2. Inside that folder: Disk1\InstData\Resource1.zip

3. Inside that zip: dist_zg_ia_sf.jar (~200MB ignore any tiny same-named stub file under dist-win, that's just a platform marker)

4. Extract this jar to disk first, then open the extracted copy fresh in 7-Zip (can't drill into a nested archive in one pass - extract, then open the extracted file as its own archive).

5. Inside, find cfusion\jetty\lib\... and copy it over the live cfusion\jetty\lib. This worked cleanly on 2 out of 3 affected PCs (both Windows 11).

The gotcha on the 3rd server (Windows Server)

Copying jetty\lib alone wasn't enough service still wouldn't start (1067), even with correct file perms and a valid JVM.

start.jar (which sits in cfusion\jetty\, not lib\) carries a hardcoded jetty.versionstring that Jetty's .mod files use to resolve jar filenames (e.g. jetty-server-${jetty.version}.jar). Our start.jar was still the old 9.4.51.v20230217, while lib\ now had 9.4.58.v20250814 jars. Version mismatch → Jetty couldn't resolve any of its own core jars → nothing to start → the JVM just exits immediately, which Windows reports as a bare 1067.

Diagnosed by running Jetty manually with its own diagnostic flag:

D:\ColdFusion2025\cfusion\jetty>jre\bin\java.exe -jar start.jar --list-config

The fix was to go back to the extracted jetty folder from the downloaded hotfix and copy of the start.jar in that folder to your jetty\lib folder, replacing the one in that folder.

Worth noting that BeyondCompare also showed that the jetty-ipaccess.xml file in the extracted archive had 127.0.0.1 added to allowed address, while (at least my) one in production did not have that IP. If you've previously modified that file and this update changed it, look in the hf-updates\backup folder and restore from there.

Posting this as a heads-up for anyone running internet facing ColdFusion.

Adobe patched CVE-2026-48282 in APSB26-68 on June 30. It’s a path traversal issue in ColdFusion 2025 Update 9 / 2023 Update 20 and earlier, rated CVSS 10.0, and Adobe’s fix is ColdFusion 2025 Update 10 / 2023 Update 21.

Adobe advisory:
https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2026-48282

The reason I’m posting is that after public technical details were released, we saw exploitation activity hit our honeypot telemetry. So this may be worth treating as more than “just another critical ColdFusion patch”.

I’d suggest checking:

• Any public ColdFusion Admin / CFIDE exposure
• Whether you’re on 2025 Update 10 or 2023 Update 21
• Web logs around July 2 onward for suspicious traversal / file-write style requests
• Any WAF rules or temporary controls while patching is being rolled out

I wrote up the observed exploitation timeline here for anyone tracking it:
https://kevintel.com/CVE-2026-48282

Not trying to spam the sub, just seemed relevant given how often ColdFusion bugs move quickly once technical details are public.

I've got a very old legacy ColdFusion app (originally written ~2008 and upgraded over the years) that I need to host temporarily while a new one is being developed. It's a long story, but there's a lot of dependencies and plumbing that just can't be upgraded. It's working now on CF2021 Developer and that was not an easy task.

I can't find a licensed copy of 2021 Standard anywhere. I just need it for ~6-8 months while the new app is being developed.

I've reached out to Adobe and asked if we can just buy the ~$900 1year subscription for CF2025 and get a key for 2021, but no response yet.

I'm kinda shocked that this has been so hard to find. Yeah it's old, but not THAT old. I worked on another project awhile back that required Windows Server 2008/SQL 2005 and was able to obtain those easily.

Why is it almost impossible to find older copies of ColdFusion? Do I not know where to look?

For older versions...

Clear Capital is looking to add a new full time ColdFusion engineer! We're looking for someone who knows CF and has kept up with modern versions and engineering practices. Ideal candidates will also have experience with AWS offerings and at least started dabbling with AI tooling. Check out the job posting here for more info:

https://clearcapitaljobs.multiscreensite.com/career-description/b3a99fa9-a27f-487a-95c1-37f551396990

Feel free to chat me with any questions and if you do apply let me know and I'll keep an eye out so you at least make it past the filters.

This month's Mid-Michigan CFUG presentation - Testing is important. Where do I start? https://youtu.be/xdmJnYAeM7I

Hello ya'll CFers!

When I became the moderator of this subreddit, it hadn't been live for about a year. I took it over knowing that I would be retiring soon, and I would want to pass it off to someone else.

Well...that retirement is getting very close! (42 days!)

I am looking for someone who would like to be the moderator here. It's a fairly easy task, but we do need someone willing to do it.

Please let me know if you are interested in being the moderator for r/coldfusion

Thanks!

Saw the this for CF Summit 2026 keynote…

Feels like it could be Ben Forta?

Or am I way off?

I am wondering if there are any media3 customers out there and what their experience has been like in the last few weeks. I migrated from hostek a few years ago and I have had some issues, but at least they had tech support and their servers have been reliable enough. I run a few CF sites and host a few Smartermail clients on a dedicated server.

In the last month the spam has been absolutely through the roof. Worse, in the last 24 hours I have lost all connection to my server, and I am not getting any response from support. Anybody else having issues? Actually I'd like to know too if any media3 customers are NOT having issues, since it looks like they have gone belly up.

I get dozens of errors every day "Timed out trying to establish connection". I opened a ticket with Hostek complaining and this is the reply from "Chad":

We have identified the cause of the errors you are seeing — your site is currently exceeding the maximum number of allowed database connections which I have pasted below:

Line 3502: User nmg already has more than 'max_user_connections' active connections Line 3663: User nmg already has more than 'max_user_connections' active connections Line 3664: User nmg already has more than 'max_user_connections' active connections Line 3721: User nmg already has more than 'max_user_connections' active connections Line 3722: User nmg already has more than 'max_user_connections' active connections Line 3723: User nmg already has more than 'max_user_connections' active connections

Unfortunately, since your account is on a shared server, some of the standard tools for resetting connections directly are not available to you. However, there are still steps you can take to resolve this.

The most effective thing you can do immediately is to have your developer review and update your ColdFusion application code. The root cause is that database connections are being opened by your application but not properly closed, causing them to build up over time.

Please ask your developer to check for the following:

1. Ensure every <cfquery> and <cfstoredproc> tag in your code has a corresponding connection close, particularly inside any error handling or conditional logic that may exit early

2. Look for any scheduled tasks or automated processes that run frequently and may be holding database connections open longer than necessary

3. Review any loops or recursive functions that execute database queries, as these can open a large number of connections in a short period of >time

4. Check that your application is not opening multiple redundant connections to the same data source within a single page request

Is it time to finally dump Hostek? It's cheap but so is this reply.

Hey fellow devs, I’m a Backend Developer currently looking for my next role. My primary focus for the last 3 years has been Adobe ColdFusion and Lucee.

I have a strong background in: Legacy & Modern CFML: Working with both Adobe and Lucee platforms. Frameworks: Heavy use of FW/1 and ColdBox. DB Performance: I enjoy the challenge of query tuning—my last major project involved a 35% performance boost via SQL optimization.
Integrations: REST APIs and AWS S3 storage.

I hold a BE in Computer Science and am well-versed in Agile/Scrum environments. If your team is looking for someone who can jump into a CFML codebase and start refactoring or building new modules immediately, I’d love to chat.

Feel free to DM me or reach out at [email protected]

Hey everyone.

"ColdFusion is a dead language." If you've been working with CFML for a while, you already know how it feels.

But as a language, CF keeps running U$ billions every day. The CFML community is small. Loyal. And completely orphaned from modern tooling. I've suffered a lot from this in our projects.

From solutions I adopted to deal with problems, a project was born, which I'm here to share with you.

B.E.N. is the first native MCP system for CFML, combining:

• MCP Server — direct integration with Trae, Cursor, VS Code and any IDE with MCP support.
• MoE + LLM Agent — intelligent routing between multiple language models.
• API Key Management and Rotation System — automatic key management with fallback, cooldown and budget control.

It is the first native MCP Server for CFML. It is an autonomous agent with intelligent routing between multiple LLMs, including local ones. It is a key management system that makes access to AI accessible even for those operating with a limited budget. Includes support for free API keys.

Integration with Agents and IDEs

Any tool that implements the MCP client can consume the server directly:

• Trae IDE : Native integration via mcp.json, the tools appear as u/cfml in the chat. This is the most direct case described in the README.
• Cursor: Built-in MCP support since 2024, same configuration as Trae.
• VS Code: Via the official Anthropic MCP extension or extensions like Continue.dev, which already support external MCP servers.
• Claude Desktop: Adds the server to claude_desktop_config.json and you have all the tools available in the desktop interface.
• Continue.dev : Open-source extension for VS Code and JetBrains that supports MCP. A good option for those who use IntelliJ or GoLand along with CFBuilder.
• Custom agents via SDK : Any code that uses u/modelcontextprotocol/sdk can connect as a client. The system's own cfml-mcp-agent is an example of this: it connects via stdio and acts autonomously.
• n8n / Make (Integromat) : with the SSE transport enabled (simply replace StdioServerTransport with SSEServerTransport in index.ts), the server becomes an HTTP endpoint that any automation platform can call. Useful for triggering TestBox tests in a GitHub deployment webhook, for example.
• GitHub Actions / CI pipelines: the MCP Server can run as a step in the pipeline, validating all .cfm/.cfc files in the PR before merging, without needing an IDE.

The only requirement to integrate with any of these tools is that they support MCP (stdio or SSE) — which is rapidly becoming standard, with Microsoft, JetBrains, and Google already announcing native support in their IDEs.

Free for:

• Personal use
• Open source projects
• Learning, experimentation, and contribution

More info, documentation and source code are available at:

https://github.com/pemartins1970/ben-cfml-mcp-system

It's an initial effort. I hope this is helpful. Issues, PRs, and feedback are very welcome.

If you use CFML in production and want to test it, especially if you have use cases that I haven't covered, send me a message.

Gert Franz, one of Lucee's cofounders, shows us what is new in Lucee 7 and beyond. He covered the new AI integration functions, enhanced Java support, ability to do vector and hybrid queries and a new secrets provider. Lucee 7 is now based on Jakarta EE instead of Java EE.

We were also joined by Mark Drew who showed us LuCli https://lucli.dev/ which is a focused command line tool just for Lucee. Lucee team member Zac Spitzer known as 'Zackster' also joined us and demoed the new and completely rewritten Lucee debugger.

Recording: https://youtu.be/qN-BGkpcAaM

Mid-Michigan ColdFusion Users Group meets in East Lansing, Michigan. The group's website is at http://www.mmcfug.org

Find our channel at https://youtube.com u/cfml

Someone mentioned that they’re doing daily CF restarts. Is this what everyone is also seeing?

I've been coding CF since v3.1, so a very, very long time. And in all these years -- almost thirty! -- I have never encountered this error.

On Thursday night, one of the MS SQL databases that we connect to had maintenance done at 8:20pm: move tempdb from one drive to another. I saw some error emails (socket error, the usual) during the outage, but by 8:40pm, the errors stopped. All good.

Friday morning, still all good -- until 10am. At this time, we started getting SQL errors, the error being none of the tables were being found. It was as if the database connection no longer connected to the correct database.

I wasn't working so I don't know exactly what happened, but all the datasources were confirmed to be correctly connected. And when the server was rebooted, this datasource no longer had any issues.

The CF service is recycled nightly, after the tempdb change. Not to mention that the server was just fine until 10am.

10am is when the west coast starts logging in, so that's when traffic begins in earnest. It's not a very busy site, we get about 80K total hits daily.

In all the years I've been working with CF, I have never seen a situation like this. Have any of you? If so, were you able to figure out what it was?

We are running CF2021, update 18 (we'll soon move over to CF2023). Maintain connections is checked on all of our MS SQL datasources, which has always been the case. We use SQL logins, not Windows.

Just in case you were not aware, there is a great CF newsletter that you can subscribe to

While the video is a bit "cheesy" it is nice to see Adobe putting in some efforts.

Gert Franz is going to show us what is new in Lucee 7 at the next Mid-Michigan CFUG meeting tonight at 7:00 pm eastern time.

Gert will cover the new AI integration functions, enhanced Java support, ability to do vector and hybrid queries and a new secrets provider. Lucee 7 is now based on Jakarta EE instead of Java EE. He is also going to share what is coming in future versions.

Meeting URL: https://msu.zoom.us/j/99430743887

Passcode: 31337

A recording will be available on our group’s YouTube channel in a few days at https://youtube.com/@cfml

Gert Franz is going to show us what is new in Lucee 7 at the next Mid-Michigan CFUG meeting on Tuesday, February 10^th  at 7:00 pm eastern time.

Gert will cover the new AI integration functions, enhanced Java support, ability to do vector and hybrid queries and a new secrets provider.  Lucee 7 is now based on Jakarta EE instead of Java EE.  He is also going to share what is coming in future versions.

Meeting URL and Passcode next week.

A recording will be available on our group’s YouTube channel in a few days at https://youtube.com/@cfml

I work in agriculture, in a place where we do a lot of research.

Because it is agriculture, our processes are very much 'seasonal'. Ridiculously so. We can't delay anything or miss deadlines- because the sun does not stop. If we do miss a cycle for some reason, the delay is a full year and that is pretty much useless. Where I work we have 6 main crops- and each of them has their own processes at different times throughout the year. So I am not tracking just one cycle, I've got many, and they are all different.

And because it is research, we are constantly doing new things. There are new processes to support, new and unique types of data to collect. If you think you have something locked down, it will 100% change in the future- which makes any sort of statistics really, really difficult to do- and reports 'break' constantly, as new pieces of data have to be integrated into reports.

When you combine Ag and Research, these two factors are just amplified. Everything is brand new (research) and the deadlines come at you like a steam locomotive (ag).

This makes everything very interesting- and at the same time very 'disposable'. We may create an entire system for a function that is only used 1 time over a 2-week period, then it will never be seen again. Then there is that 1 out of 10 situation where the same processes are done again, which is always a surprise.

As far as CF development goes, that means things must be created very quickly. It is not uncommon for me to find out on Tuesday, that we will have 10 people collecting data the following Monday, and things need to work. And since I know that 85% of what is written will never be used again, it's really hard to spend too much time on any specific features.

I bring all of this up because ColdFusion's rapid development is key to making this happen. If I can't develop things quickly, I will never be able to support the people who use the systems.

I am interested in hearing about the specific challenges you have in your industry or particular situation. For instance if you are in finance, I am guessing that each transaction needs to be scrutinized and validated- which is about the furthest thing from my situation.

Let's hear about the circumstances that form your particular development efforts!

Hi there.

I'm new to neovim and something I want to try. Most of the tutorials that I've seen revolve around setting up other popular languages.

Has anybody succeeded in making a CF "IDE" with neovim/lazyvim?

Currently, I'm using VS Code + Adobe CF Extension + CF Lint.

Like a lot of us I'm beginning to wrap my head around specific methodologies for leveraging AI models from my existing CF app. I've watched a few of the Summit 2026 videos - Ray's and Nikhil Dubey's. Ray shows pretty a straightforward REST-based method for invoking Gemini (or any other model). Nikhil's demo relies on a not-yet-released version of CF 2026 which seems to have some AI connectivity baked in. Well, this raises a lot of questions. Like what do we know about the upcoming release at this point? And, as I've expected for a while, Adobe is moving to a subscription licensing model? Anybody know what that's going to mean?

Upgraded from an intel MacBook Pro to a new shiny Mac mini m4. One of the projects I am working on requires IIS and url rewrites through IIS.

In researching potential speed bumps in transitioning to the silicon chip, I read that the IIS rewrites didn't work for many people. That would be a showstopper. And rewriting in another format was not an option for me.

After spending way too much time researching ARM64 compatibility patches and workarounds, I’m happy to report that IIS URL Rewrite Module just works on Windows 11 ARM in Parallels Desktop. At least for me this worked.

My Setup:

∙ Mac Mini M4 (Apple Silicon)

∙ Parallels Desktop 26

∙ Windows 11 ARM64 (not x64)

∙ ColdFusion 2023 development environment

What Actually Worked:

1. Enable IIS through Windows Features (Internet Information Services + Web Management Tools)
2. Download the AMD version of the url rewrite from Microsoft. Install it.
3. That's it. URL rewrites worked as expected.

What I Didn’t Need:

∙ ❌ The ARM64 URL Rewrite patch from GitHub (tig/rewrite-arm64)

∙ ❌ Windows 11 x64 emulation (way too slow)

∙ ❌ Tuckey URLRewriteFilter or other Java-based alternatives (not allowed)

∙ ❌ Any registry hacks or workarounds

Why This Works:

Windows 11 ARM’s x64 emulation has gotten really good, especially in recent builds. The URL Rewrite module DLL runs through the built-in x64 emulation layer transparently. Microsoft and Parallels have clearly improved compatibility significantly.

Performance:

Native ARM64 Windows on the M4 is fast. Way better than trying to run x64 Windows which requires double emulation (x64 → Rosetta → ARM64).

Bottom Line:

If you’re developing on Apple Silicon and need IIS with URL Rewrite (for ColdFusion, ASP.NET, or any IIS-based development), don’t overthink it - just install the standard x64 URL Rewrite module on Windows 11 ARM. It works.

Hope this saves someone else the hours of research I went through!

Day 3 CF Online Summit Session Recordings
https://www.youtube.com/@adobecoldfusion

• Agentic AI with ColdFusion – Michael Hayes
• ColdFusion Security in Action: Defend, Secure, and Update – Satyam Mishra
• Modern ColdFusion: Unlocking Scalable, Asynchronous, Multithreaded and Cloud Ready Distributed Architecture – Rickson Chew
• Stop developing on production! CI/CD pipelines for small business that are fast, effective, and inexpensivev – David Byers
• Shipping Faster and Safer with AI in Engineering – Brian Sappey
• Building a custom AI agent and how ColdFusion can interact with it – Monte Chan