**Oracle Java SE Multiple Vulnerabilities**
          
==Backup directory defined here: (Settings -\>Java and JVM -\> Java virtual machine path).==  
==Install Java over top of this location.==
 
==Use Microsoft CAPI for certificates (verify setting )==  
JVM Arguments: (added at end of file)  
-Dcom.sun.jndi.ldap.connect.pool.debug=all -Djavax.net.ssl.trustStore=NUL  
-Djavax.net.ssl.trustStoreType=Windows-ROOT
 
[Installing and troubleshooting Java updates in ColdFusion - ColdFusion (adobe.com)](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)
 
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3)  
Select the installers and other tools for a ColdFusion version.
 
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers)
      

We're running Coldfusion 2018 at the latest patch level, and have been notified by our security folks that we're using a vulnerable version of the JRE (1.11.0_01).  I'm new to administering Coldfusion and wanted to know what the best practices are for performing JRE updates.  Should we be expecting updates to be included in the Coldfusion updates (I assume not, given how behind we are)?  If not, should we only be applying versions available here ( [https://www.adobe.com/support/coldfusion/downloads.html](https://www.adobe.com/support/coldfusion/downloads.html))?  Is this a good reference on how to apply the updates? ([https://www.petefreitag.com/item/860.cfm)](https://www.petefreitag.com/item/860.cfm)
 
**1 Correct answer**

![Charlie Arehart](Exported%20image%2020250808202314-0.png)

   
**Charlie Arehart** • _Community Expert_ , _Jan 10, 2022_  
To answer your questions, no, yes, yes. [Edit: initially I said "no" as the last answer, but that was clearly a mis-typing, as supported by what I said below about Pete's helpful post.]  
   
And if you show running 11.0.1, you can see that's clearly NOT "the latest", even as offered on that Adobe page, specifically [the section on Java downloads](https://www.adobe.com/support/coldfusion/downloads.html#additionalThirdPartyInstallers) (though good news is that the page DOES show the current latest, which is 11.0.13 at the moment. )  
   
And to be clear, that's the latest update to Java 11, n
 \> From \<[https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783](https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783)\>   
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers) ==at bottom of page………………………………………………..==
 33. ==Download the latest version of Java from==  ==http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html====. Please make sure that you download 64-bit Java for 64-bit ColdFusion and 32-bit Java for 32 bit ColdFusion.==

[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers)
 36. ==Stop ColdFusion Services==
37. ==Run the installer to install Java.==
38. ==Take a backup of jvm.config(located at== D:\ColdFusion2023\cfusion\bin\jvm.config==)==
39. ==To change from ColdFusion’s default Java, modify the Java home url in either jvm.config or in ColdFusion administrator (Settings -\>Java and JVM -\> Java virtual machine path).==
40. ==Backup D==:\ColdFusion2023\jre folder (use this as the install path.)
41. Install new JDK version. 43. ==Restart ColdFusion after making the changes.==
44. ==To verify the update, log in to ColdFusion Administrator and see verify the newer Java version .==

Note: Any SSL certificates added to the previous JDK will also need to be re-added to the new JDK (cacerts) file.  
You can use Java keytool tool located in Javajre1.8.0_XXbin to import the certificate.  You can use the below command:  
keytool -import -alias name -keystore Javajre1.8.0_XXlibsecuritycacerts -file mycert.cer  
   
**Java upgrade issues and troubleshooting**

46. ==If you are== **unable to start ColdFusion** ==after the Java update:==
    
    - ==Check the location of Java home in jvm.config.==
    - ==The J==**ava auto-update** ==modifies the Java install directory location, which causes failure to ColdFusion start. Disable the java auto upgrade.==
    - ==Try starting ColdFusion from command line to see specific errors. If the error is "Error loading: C:Program FilesJavajdk1.X.Xjrebinserverjvm.dll", then copy the== **msvcr100.dll** ==file to \<cf_install_root\>/cfusion/bin from {JDK8_Home}/bin (for Windows OS).==
47. ==After importing certificates, if you have issues related to SSL, then you need to enable debugging for SSL. Take a backup of jvm.config at ColdFusioncfusionbin and add== **-Djavax.net.debug=all** ==under the “Arguments to VM” in jvm.config. This would require a CF service restart. The argument would append the debugging info to the coldfusion-out.log at ColdFusioncfusionlogs.== \> From \<[https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)\>  
                         \> From \<[https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783](https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783)\>         \> From \<[https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)\>  
 
Java installers  
[https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3)
   

Download jdk…x64_bin.exe  
Stop ColdFusion 2023 Application Server service  
**Remove previous backup copies**  
**Backup D:\ColdFusion2023\jre** **(Right click drag copy here)**  
**Backup D:\ColdFusion2023\cfusion\bin** **(Right click drag copy here)**
 
Run as administrator jdk…x64_bin.exe

![Exported image](Exported%20image%2020250808202314-1.png)  
![Exported image](Exported%20image%2020250808202315-2.png)  

**Change** **point to D:\ColdFusion2023\jre**

![Exported image](Exported%20image%2020250808202316-3.png)  
![Exported image](Exported%20image%2020250808202316-4.png)  
![Exported image](Exported%20image%2020250808202320-5.png)  
![Exported image](Exported%20image%2020250808202321-6.png)  

**Start ColdFusion services**  
Login to Admin console and verify update [ColdFusion Administrator](http://127.0.0.1:8500/CFIDE/administrator/index.cfm?target=/CFIDE/administrator/settings/server_settings.cfm)

![Exported image](Exported%20image%2020250808202322-7.png)                  
[New updates released for Java 8, 11, and 17, as of Jan 2022 - Charlie Arehart - Server Troubleshooting (carehart.org)](https://www.carehart.org/blog/client/index.cfm/2022/1/24/java_updates_Jan_2021)