Versions & End of Life
Quick answer
Adobe supports each ColdFusion release with about five years of core support (updates and security fixes) plus one year of extended support that does not include patches. As of October 2026, only ColdFusion 2023 and 2025 receive security updates; ColdFusion 2021 core support ended November 10, 2025.
Each Adobe ColdFusion release gets about five years of core support, followed by one year of extended support. Core support includes updates, bug fixes and security patches. Extended support is best-effort help with migrating to a supported version. Adobe states it does not include security patches or hotfixes. In practice, a ColdFusion release stops receiving security fixes the day core support ends.
As of October 2026, only ColdFusion 2023 and ColdFusion 2025 receive updates and security patches.
New vulnerabilities in an unsupported release are never patched. Over time, newer Java versions, operating systems, databases and third-party services also stop working with it, and compliance frameworks such as PCI DSS expect supported, patched software. The application keeps running, but the risk grows every month.
Not sure which path fits your application? A short consultation and a compatibility audit will tell you which option costs less.
No. Adobe describes extended support as best-effort help with migrating to a supported version, and states that it does not include security patches or hotfixes. Security fixes stop when core support ends.
No. Core support for ColdFusion 2021 ended on November 10, 2025, so it no longer receives updates or security fixes. Extended support runs to November 10, 2026 but only covers migration help.
ColdFusion 2025 is the newest Adobe release. It is sold as a subscription rather than a perpetual license. ColdFusion 2023 is also still in core support.
Adobe ColdFusion and Lucee specialists for 20+ years. Book a free consultation and get a straight answer.
Book a Free Consultation