The update patches the same server-side request forgery vulnerability patched in ColdFusion (CVE-2015-5255) and also includes a new version of BlazeDS, a Java-based remote messaging feature included in both products. James Kettle of PortSwigger Web Security is credited with reporting the issue to Adobe.