Read on for more, including details and observations I offer about what else has changed with this update, as well as concluding thoughts on best practices regarding any CF update.
TLDR: The new updates are 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 1.8.0_501 (aka 8u501) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).
More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of some of the compatibility-oriented changes listed for the updates.)
FWIW, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.
For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.
In brief, this update is another classed by Adobe as a P1 (Priority 1, "Critical") security update. Specifically, the Adobe produce security bulletin (linked to below) indicates that the update addresses "vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass". And while it also says that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates", note that it's not uncommon that the vulns will immediately be being reverse-engineered and exploited by bad guys--or good guys trying to warn folks.
As such, it's always important to apply CF updates, and still more important for CF security updates, but then especially if they are classed as "critical" like this (though it's also true that some vulns are in features that may be disabled by default, or disabled for you, in which case their urgency is diminished).
Finally, as happens with about 30% of CF security updates, this one has a potential breaking change (which could affect some apps but not all), and there is a new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.
Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.
In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." Even so, in the days after there have here have been public announcements of one or more of the vulns being reverse-engineered and exploited, as I discuss below.
Even so, as happens with about 30% of CF security updates, this one has potential breaking changes (which could affect some apps but not all), and there are also new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.
Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.
In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
The update also includes a still-more recent update to the version of Tomcat embedded within each CF version than previous CF updates. To be clear, there are no other changes, bug fixes, or known issues indicated for this update.
FWIW, some may know that Adobe released an update just last month--which was ONLY for CF2025, as I discussed in a post that day, May 20. That DID include many new features and changes (including changed behaviors), so note that if you are on CF2025 and are skipping from update 7 or earlier, look to that post for more before proceeding.
And like with each CF update, I share the details about the update (from Adobe and from others) as well as additional info you may want to consider before (or after) doing the update.
Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.
In this post, I point out how one can participate in the prerelease (including seeing its substantial docs and obtaining the prerelease update adding the new features). I can't share news of what's IN the new version, per the info available in those prerelease docs. But in a follow-on post I will offer links to the recordings of several recent Adobe webinars, from mid-April 2026, where Adobe CF team members shared several hours of presentations about what's coming (again on more than just the new AI features).
Here are the topics I cover in this post:
TLDR: The new updates are 26.0.1, 25.0.3, 21.0.11, 17.0.19, 11.0.31, and 1.8.0_491 (aka 8u491) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).
More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the compatibility-oriented changes listed for the updates.)
Also, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.
For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.
(This is the second update since CF2021 has reached its end of life as I blogged previously, which is something folks running that should beware. You are now QUITE exposed to things fixed in these two updates, for which there is no fix for you.)
In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update.
Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.
Managed Hosting Services provided by
