Support status · ColdFusion
Is the ColdFusion version you run still getting security patches?
Adobe closes support on a published schedule. Once your release passes that date, vulnerabilities found in it stay open — permanently. Here is how to find out where you stand, and what the options actually are.
Free written status check · No obligation · We will tell you if you are fine
- Written support-status check
- Free
- Typical turnaround
- 3 days
- The report, whatever you decide
- Yours
The situation
If any of this sounds familiar, you are in the right place
Nobody is sure which version is actually running
The answer in the wiki is from the last upgrade, and the last upgrade may not have happened. The version in production is a question, not a fact, in most estates we look at.
End of support is not the same as end of working
The application keeps serving traffic exactly as before, which is precisely why this gets deferred. Nothing visibly breaks on the date. The exposure just stops being fixable.
The upgrade path has its own cost
Moving to a supported release is not free either — licences, testing, and whatever broke between versions. That real cost is what makes "do nothing" keep winning.
What we do
How we approach it
Your actual version, confirmed
Not the one in the documentation. We establish what is really deployed, on which JVM, with which update level applied, and put it in writing.
Support status against the published schedule
Core support, extended support, or past both — stated plainly with the dates, so you can put a defensible answer on a questionnaire instead of a hopeful one.
Exposure in specific terms
Which known vulnerabilities apply to what you run, whether they are reachable given your configuration, and which are already being exploited in the wild.
Every option priced, including staying
Update in place, move to a supported release, move to Lucee, or leave the platform. Staying put is a legitimate answer and sometimes the correct one — we will say so when it is.
The engagement
How it runs
You tell us what you know
Version if you have it, a rough sense of the estate if you do not. Two minutes on the form is enough to start.
We establish the real position
Deployed version, update level, JVM, and how the app is exposed to the network.
You get the status in writing
Support state, applicable vulnerabilities, and the honest risk read — a page you can forward without editing.
Options, with numbers
Each realistic path costed and sequenced. No pressure to pick the one that pays us.
Questions
Frequently asked
How do I find out which ColdFusion version I am running?
The administrator console shows it on the front page, and the update level matters as much as the major version — an unpatched supported release can be more exposed than a patched older one. If you cannot get into the console, the server logs and the JVM arguments will usually tell us. Send whatever you have and we will work it out.
What actually changes on the day support ends?
Nothing visible. The application runs exactly as it did. What changes is that any vulnerability discovered from that point onward will never be patched for your release, so your exposure only ever grows. It is a slope, not a cliff, which is why it is easy to keep deferring.
Is an unsupported ColdFusion server really a serious risk?
It depends entirely on exposure. An internet-facing CF server on an unsupported release is a genuinely serious problem — ColdFusion has attracted several vulnerabilities that were exploited in the wild shortly after disclosure. An internal-only application behind a VPN, with no file upload and no untrusted input, is a much smaller problem. We assess yours rather than assuming.
Can I just stay on the version I have?
Sometimes, yes — with compensating controls, network isolation and a clear-eyed record of the decision. That is a defensible position if it is deliberate and documented. It is not defensible if it is accidental, which is the situation most estates are actually in.
Is moving to Lucee a real alternative?
For many applications, yes. Lucee is an open-source CFML engine and removes the licence line entirely. Compatibility is good but not total, so the honest answer depends on which tags, functions and Adobe-specific features your code uses. That is a measurable question and we measure it rather than guessing.
What do you charge for the status check?
Nothing. It is a genuinely free written check, because most of what makes it valuable to you is cheap for us to establish. If it turns out you want a migration afterwards, we would like to be considered — but the report is yours either way, including the parts that say you are fine.
Check your ColdFusion support status
Tell us what you know about the estate. We will confirm the real position and send it back in writing.