ColdFusion Upgrade and Migration Services
Still on an older ColdFusion version? It probably still runs, and that is part of the risk. Versions that no longer get security updates keep working right up until someone finds a hole in them. Contact us for a FREE consultation and we will tell you what an upgrade would involve for your application.
| The short version: where Coldfusion versions stand today |
|---|
| ColdFusion 10, 11, 2016 and 2018 are all past end of life. ColdFusion 2021 passed the end of core support on November 10, 2025, and the paid extended support that follows does not include security patches |
| ColdFusion 2023 is supported until May 2028. ColdFusion 2025, released in February 2025, is the current release and is supported into 2030 |
| ColdFusion 2025 runs only on Java 21 and Tomcat 10.1, so custom Java libraries, WARs and server connector settings need checking before you move |
| We install the new version beside the old one, test your real application on it, then cut over with a rollback plan |
| Moving from ColdFusion 2025 Update 8 or later also gives you the native AI framework, if you want it later |
ColdFusion is one of the oldest web application platforms still in daily use. It was early, it lost some of the spotlight to Java and .NET, and a great many organisations kept their applications on it anyway because those applications work and the business depends on them. That is the right instinct. Rewriting a working application from scratch is expensive and risky. Keeping the platform under it current is not.
Adobe ships regular updates, and each major release changes what runs underneath your code: the Java version, the application server, the supported operating systems and the security model. Upgrading is mostly about managing those changes carefully. We have done this for 600+ clients over more than 25 years as an official Adobe ColdFusion Partner, across many ColdFusion versions, up to ColdFusion 2025.
Which ColdFusion Versions Are Still Supported?
This is the first question to settle, because it decides how urgent the work is. Dates below follow Adobe’s published lifecycle, as of October 2026.
| ColdFusion version | Core support | Where that leaves you |
|---|---|---|
| ColdFusion 10 | Ended May 2017 | Unsupported for years. No security fixes. |
| ColdFusion 11 | Ended April 2019 | Unsupported. No security fixes. |
| ColdFusion 2016 | Ended February 2021 | Unsupported. No security fixes. |
| ColdFusion 2018 | Ended July 2023 | Unsupported. Extended support also ended in July 2024. |
| ColdFusion 2021 | Ended November 10, 2025 | Paid extended support runs to November 10, 2026, but Adobe states it does not include security patches or hotfixes. |
| ColdFusion 2023 | Until May 16, 2028 | Supported. Extended support to May 2029. |
| ColdFusion 2025 | Until February 2030 | Current release. Security updates arrive regularly. |
The latest ColdFusion 2025 security update at the time of writing is Update 13 (September 2026). A server that is not on a supported version cannot install it. See our page on ColdFusion updates, hotfixes and security patches for how we keep supported servers current.
Why Upgrade ColdFusion
• Security: Unsupported versions receive no fixes for newly found vulnerabilities in ColdFusion itself, in Tomcat, or in the libraries bundled with them. Recent ColdFusion 2025 updates have each fixed issues such as code execution and file read flaws. Older servers stay exposed to all of them.
• Supported Java and operating systems: Newer ColdFusion releases run on current Java versions and current operating systems. ColdFusion 2025 supports Windows Server 2022, RHEL 9.5 and later, Ubuntu 24 LTS and SUSE 15.5 and later.
• Compliance and audits: Auditors and insurers increasingly ask whether the software you run still receives security patches. An end-of-life platform is hard to defend.
• Performance and stability: Newer Java runtimes and ColdFusion builds bring real gains in some applications. An upgrade is not automatically faster, so we measure first. See our ColdFusion performance audit if speed is your main concern.
• New capabilities: ColdFusion 2025 Update 8 added a native AI framework with chat models, vector stores and RAG, and MCP support. You do not need any of it to upgrade, but it is available when you want it. See AI integration services for ColdFusion.
ColdFusion 2025 or ColdFusion 2023?
For most clients we recommend ColdFusion 2025, because it has the longest support runway and the newest security baseline. ColdFusion 2023 is a sound choice in some situations, and we will tell you honestly which one fits.
- Choose ColdFusion 2025 when you want the longest support window, you are starting a migration now, or you plan to use the native AI features. It requires Java 21 and runs on Tomcat 10.1.
- Consider ColdFusion 2023 when you already hold a ColdFusion 2023 licence, a required third-party component is not yet ready for Java 21 or Tomcat 10.1, or your change window is tight. It is supported until May 2028, which gives time for a second move later.
ColdFusion 2025 is available through subscription licensing; Adobe no longer offers perpetual licences for new purchases. Customers with an active ColdFusion 2023 or earlier licence may have upgrade-pricing options, and some recently purchased ColdFusion 2023 licences may qualify for an upgrade. Eligibility depends on the licence and account details, so confirm the available options with Adobe before making a licensing decision.
What Changes When You Move to ColdFusion 2025
The headline changes are underneath your code. These are the points we check on every project:
- Java 21 only: ColdFusion 2025 supports Java 21 and not Java 17 or 11. Custom Java classes, JAR files and drivers need to work on Java 21.
- Tomcat 10.1 and the move from javax to jakarta: The servlet package namespace changed. Standard server installs are largely unaffected, but custom JARs, WARs or EARs built for the older specification need updating or replacing. Connector settings in server.xml also follow the stricter standard format, so SSL configuration often needs rewriting.
- Removed and changed features: Some older options no longer work. For example, the cfmx_compat encryption algorithm value fails, and several legacy JVM arguments are ignored. Adobe publishes a list of deprecated and removed features, and we check your code against it.
- Platform support: Solaris, WebLogic, WebSphere and DB2 are no longer supported by ColdFusion 2025. If you depend on one of those, we need to talk early.
- Skipping versions: Moving from ColdFusion 2021 is usually a moderate project. Moving from ColdFusion 10, 11 or 2016 crosses many years of removed tags, functions and settings, and needs more testing. We have done both.
How We Run a ColdFusion Upgrade
- Discovery and inventory: we record your current version and update level, Java, operating system, web server connector, datasources, scheduled tasks, custom tags, CFX tags, JARs and any third-party integrations.
- Compatibility review: we scan your code and settings against the deprecated and removed feature lists for the target version and report what will break and what needs checking.
- Side-by-side build: we install the new version next to the old one and configure your web server so a test site can point at it. Your production server is not touched.
- Settings migration: we move server settings, datasources and security configuration using ColdFusion’s cfsetup tool where it fits, and we re-enter or re-secure credentials correctly.
- Hardening: we apply the Adobe lockdown guidance, secure the Administrator and install the latest update.
- Testing: we test your real application on the new version, fix what breaks, and compare behaviour and speed against the old server.
- Cutover with a rollback plan: we agree a window, switch over, watch the server closely, and keep the old environment available until you are comfortable.
- Handover: you receive notes on what changed, the settings used, and anything your own team should watch.
The schedule depends on your current ColdFusion version, application complexity, custom Java libraries and integrations, and the amount of testing required. After discovery and the compatibility review, we provide a project-specific timeline before work begins.
What We Can Help With
- Upgrading to ColdFusion 2025 or ColdFusion 2023 from ColdFusion 10, 11, 2016, 2018 or 2021
- Moving ColdFusion to a new server, a new operating system, or a new Java version
- Code fixes for removed or changed features found during testing
- Updating custom Java code, JARs and drivers for Java 21 and Tomcat 10.1
- Securing and locking down the new server
- Installing the latest ColdFusion updates and keeping them current: see ColdFusion maintenance and support
- Planning the move when a full rewrite is on the table, through ColdFusion consulting
Why IT Landmark
- Official Adobe ColdFusion Partner.More than 25 years working with ColdFusion, and 300 clients served.
- We test before we touch production.Your application runs on the new version in a safe environment first.
- Honest advice on the target version.We recommend ColdFusion 2025 or 2023 based on your situation, not on what is easiest for us.
- One team for the whole picture.Server, Java, database and CFML code are handled together.
Frequently Asked Questions
Is it risky to run ColdFusion 2018 or older?
Yes. ColdFusion 2018 reached end of life in July 2023, and ColdFusion 10, 11 and 2016 ended earlier. They receive no security fixes, so any vulnerability found since then stays open on your server.
ColdFusion 2021 still works. Do we need to upgrade now?
Core support for ColdFusion 2021 ended on November 10, 2025. Adobe’s paid extended support continues to November 10, 2026 but does not include security patches, so the practical answer is to plan the move now rather than wait for the last date.
Can we skip ColdFusion 2023 and go straight to ColdFusion 2025?
Yes, in most cases. We move you straight to the version you are targeting. The work is in testing your application against the removed and changed features between your current version and the target.
Will our existing code still run?
Most of it will. Applications from ColdFusion 2021 usually need small fixes. Applications from ColdFusion 10, 11 or 2016 need more, because more features were removed along the way. Our compatibility review tells you before you commit to anything.
Do we need to change our licence?
ColdFusion 2025 uses subscription licensing. Adobe says upgrade pricing may be available for customers with an active ColdFusion 2023 or earlier licence, while eligibility for a specific licence must be confirmed with Adobe. We can help you review the options with your Adobe account representative.
Can you upgrade without downtime?
We build and test the new environment beside the old one, so downtime is limited to the cutover window. We agree that window with you and keep the old server available for rollback.
We run Lucee. Is this the same?
No. This page covers Adobe ColdFusion. If you are considering a move between Adobe ColdFusion and another CFML engine, talk to us first and we will lay out the trade-offs.
Need Help? We Are Here for You
Tell us which version you run today and where you want to be, and we will tell you plainly what the move involves. Contact us for a FREE consultation or email contact@itlandmark.com or call 1-844-440-0059.