Tell a room of developers that ColdFusion is still in production in 2026 and you get the laugh. Tell them what it runs and the room goes quiet: insurance plan management, continuing education platforms with regulatory reporting, municipal finance systems, member services with decades of records. These are systems where a mistake costs an audit or a lawsuit, not a lost signup.
So yes, ColdFusion is still used in 2026, and Adobe still supports it: on Adobe's published support timeline, ColdFusion 2025 has core support until February 26, 2030. The problem is not that these systems exist. The problem is how many of them run unmanaged. We have built and maintained ColdFusion systems since 1998, and most of our ColdFusion work now is remediation and modernization, so we see that difference up close.
Why is ColdFusion still in production?
ColdFusion apps survive because they hold business rules that exist nowhere else: rate calculations, eligibility logic, state-by-state compliance quirks, and the fix for every edge case a real customer ever hit. The application is often the only complete record of how the business works.
That is not technical debt in the dismissive sense. It is an asset with a maintenance problem. Replacing it means rediscovering every one of those rules, and teams that treat the rewrite as a greenfield project rediscover them one production incident at a time.
"Dead language" is commentary shorthand, not an engineering fact. Adobe released ColdFusion 2025 on February 25, 2025, so every older version has a supported version to upgrade to.
What is the real risk of running ColdFusion?
The real risk of running ColdFusion is unmanaged operation. These are the findings we see most when we assess a ColdFusion application:
End-of-life runtimes on the public internet. An end-of-life runtime is a version past the last date on the vendor's support timeline. ColdFusion 10 and 11 servers still serve public traffic, years after Adobe's extended support ended on May 16, 2019 and April 30, 2021. The threat is on the record. In December 2023, CISA reported that attackers exploited CVE-2023-26360 to compromise two public-facing ColdFusion servers at a federal civilian agency in June 2023, and it listed the unsupported versions 2016 and 11 as affected. This is our most common serious finding.
No source control. More common than anyone admits. Editing production files is the deployment process, so fixes regress, nothing is audited, and disaster recovery is a hope. When we find this, it goes to the top of the list, ahead of any platform discussion.
Knowledge held by one person, or nobody. The developer who understood the system retired. The team makes only the changes it can make safely, and that list shrinks every year. The application still works. The ability to change it is what died.
Databases and reporting aging alongside the app. An upgrade discussion always arrives dragging a SQL Server version, a reporting layer, and an authentication setup behind it. They age as a unit.
Every item on that list is a management decision, not a technology verdict. A patched, version-controlled, documented ColdFusion 2025 application on supported infrastructure is a defensible home for a stable line-of-business system. An unpatched ColdFusion 10 server deployed over FTP is not, and rewriting it in a fashionable stack with the same habits produces a fashionable unpatched server.
What good ColdFusion stewardship looks like
Teams that run ColdFusion well know what they run and what it touches. They keep the runtime on a supported version. With ColdFusion 2021 in extended support only until November 10, 2026, many of them have an upgrade to finish in 2026, and our CF2025 migration field checklist covers that move. They put source control and a deployment path in place before anything bigger. They modernize when the business needs faster change, not out of embarrassment about the logo on the runtime.
Embarrassment is a poor input to architecture. Risk exposure, change frequency, and business criticality are good ones, and our decision framework for legacy applications turns them into a choice between remediate, modernize, rewrite, or leave alone. If the answer is migration, how we plan a ColdFusion migration starts with triage, not a target language.
If you run ColdFusion and are not sure which of these describes your servers, that assessment is the work we do most: ColdFusion support and ColdFusion security remediation.