Support status · ColdFusion
Is the ColdFusion version you run still supported?
It depends on your version, and for most estates the answer is no.
ColdFusion 2018, 2016, 11 and 10 are fully unsupported and receive no security updates. ColdFusion 2021 left core support on 10 November 2025 and its extended support ends on 10 November 2026. Extended support for ColdFusion explicitly includes no security patches and no hotfixes, so a 2021 estate is already running without fixes today. ColdFusion 2023 and 2025 are current. The update level matters as much as the major version: an unpatched supported release can be more exposed than a patched older one.
- ColdFusion 2018 and older
- Unsupported. No security updates
- ColdFusion 2021
- Extended support ends 10 November 2026
- ColdFusion 2023
- Supported until 16 May 2028
- ColdFusion 2025
- Supported until 8 April 2030
Source: Adobe: ColdFusion product support lifecycle. Check it. We would rather you did.
- Dates from Adobe, linked
- No email needed to read them
- Patch and stay is a real answer
What that actually means
The position most estates are in
Nobody is sure which version is actually running
The answer in the wiki is from the last upgrade, and the last upgrade may not have happened. The version in production is a question rather than a fact in most estates, and the applied update level is almost never recorded anywhere.
End of support is not the same as end of working
The application keeps serving traffic exactly as before, which is precisely why this gets deferred. Nothing visibly breaks on the date. The exposure just stops being fixable.
ColdFusion vulnerabilities get exploited fast
This platform has repeatedly attracted critical, unauthenticated remote code execution flaws, and the gap between public disclosure and exploitation in the wild has been measured in hours rather than weeks. On an unsupported release there is no patch to race for.
Exposure
What breaks, how likely, what it costs
Stated generically here because it is generic until someone looks at your estate. These are the scenarios that actually land, in the columns your risk register already has.
| Scenario | Likelihood | Impact |
|---|---|---|
| A critical unauthenticated RCE is disclosed for your release | Has happened repeatedly on this platform | On an unsupported release there is no patch. Exploitation has followed disclosure within hours |
| A supplier or insurer asks whether any software in scope is unsupported | Routine, and increasing | An honest answer names an unsupported application runtime in production |
| A Cyber Essentials or ISO assessment reaches the estate | Annual, if you certify | Unsupported software in scope is an automatic failure rather than a finding to discuss |
| An attack campaign targets a holiday period | Observed against this platform specifically | Probing of older CVEs at volume while the smallest number of people are watching |
What we do about it
The work itself
Your actual version and update level, established
Not the one in the documentation. What is really deployed, on which JVM, with which updates applied, because the update level changes the answer as much as the version does.
What the application does, recovered from the code
CFML read at volume and written down as business rules a reader who has never seen a cfquery can follow. This is the deliverable that makes every subsequent decision cheaper, whoever ends up doing the work.
Behaviour pinned before anything moves
Characterisation tests driven through HTTP against the running application, so the replacement is verified against what the software really does rather than what anyone remembers it doing.
Moved in pieces, with the old stack still serving
Route by route, both versions live, each step independently revertible. No date on which everything changes and everyone hopes.
What decides the cost
The three things worth knowing before anyone quotes
- Update level
- Which cumulative updates have actually been applied. This changes your exposure more than the major version number does, and it is rarely written down.
- Network exposure
- An internet-facing CF server on an unsupported release is a different problem from an internal application behind a VPN with no untrusted input.
- Adobe-specific features
- How much of the code depends on Adobe-only tags and features decides whether Lucee is a cheap answer or a false one.
The engagement
How the work runs
You tell us what you know
Version if you have it, a rough sense of the estate if you do not. Two minutes on the form is enough to start a real conversation.
We read the code
The reachable surface, the data access, the custom tags and the parts that are provably dead.
One route goes first
A real route, in production, behind the same URL, with ColdFusion still serving everything else. This is where the estimate stops being a guess.
The rest follows in that order
Measured against the first route rather than padded, sequenced so the most exposed paths leave the unsupported runtime earliest.
Questions
Frequently asked
Which ColdFusion versions are still supported?
ColdFusion 2023 and 2025 are current, with published end dates of 16 May 2028 and 8 April 2030. ColdFusion 2021 left core support on 10 November 2025 and its extended support ends on 10 November 2026. ColdFusion 2018, 2016, 11 and 10 are fully unsupported. One important detail: Adobe's extended support for ColdFusion does not include security patches or hotfixes, so "in extended support" does not mean "still getting fixes".
How do I find out which version I am running?
The administrator console shows it on the front page, and the update level matters as much as the major version: an unpatched supported release can be more exposed than a patched older one. If you cannot get into the console, the server logs and the JVM arguments will usually tell us. Send whatever you have.
What actually changes on the day support ends?
Nothing visible. The application runs exactly as it did. What changes is that any vulnerability discovered from that point onward will never be patched for your release, so your exposure only ever grows. It is a slope rather than a cliff, which is why it is easy to keep deferring.
Is an unsupported ColdFusion server really a serious risk?
It depends on exposure, and the honest answer differs a lot between estates. An internet-facing CF server on an unsupported release is a genuinely serious problem, because this platform keeps attracting critical unauthenticated flaws. An internal-only application behind a VPN, with no file upload and no untrusted input, is a much smaller problem. Those two should not receive the same advice.
Can I just stay on the version I have?
Sometimes, yes, with compensating controls, network isolation and a written record of the decision. That is a defensible position when it is deliberate and documented. It is not defensible when it is accidental, which is the situation most estates are actually in, and it is the difference an assessor will look for.
Is moving to Lucee a real alternative?
For many applications, yes. Lucee is an open-source CFML engine and removes the licence line entirely. Compatibility is good but not total, so the honest answer depends on which tags, functions and Adobe-specific features your code uses. That is a measurable question rather than a matter of opinion: run the code against a Lucee build and count what breaks.
Do you charge to tell us our support status?
No, and it is not a lead magnet either: the dates are on this page and Adobe publishes them. What we sell is the rewrite: reading the application, pinning its behaviour with tests, and moving it to TypeScript in pieces with the old stack still serving. If the right answer for you is to patch and stay, we will say that, and there is nothing to buy.
Talk to someone who would read the code
A name, an email, and three optional questions. What comes back is a reply from the engineer who would read the code, and it is either a conversation about replacing it or an honest reason why we are not the right people.
Other platforms