The CF 2021 Update 11 release notes say:

The cflogging.jar file isn't automatically removed after you apply the update, even though we've removed the file from cfusion/lib.

Ensure that you remove the file manually.

Where is that? I checked on a 2021 server that hasn't been updated to update 11, and it's nowhere under ColdFusion2021.

Just saw a post in the CF discussions asking the same thing ( https://community.adobe.com/t5/coldfusion-discussions/coldfusion2018-update-15-new-log4j-issue/m-p/14179826 ) Apparently they can be purged and the updates are located at (depending on update) C:\ColdFusion2021\cfusion\hf-updates\hf-2021-00006-330132\backup\lib

So it's only in various /backups/ directories? Presumably it has no effect there, can't be accessed, right? Not a risk, other than being picked up by security scans?

I just checked the security on that folder (did the lockdown at install) and there is no user entries but admin/system. Empirically, I tried manually typing in a url to 127.0.0.1:<your port>/hf-updates/<whichever hf folder you want>/hotfix_filelist.log and tried to browse to it - nothing. I tried it on a local install and dev box with nothing but 404's. Maybe confirm for yourself, too? I'm thinking it's inaccessible unless you (for example) intentionally create a site in IIS that points to that destination and grant privileges to that folder for said purpose.

Good idea @Jim Frankowski. I get the same result you do. So it seems that in most cases that instruction in the release notes can be a no-op.

This has to manually moved to backup directory, we will take care of this in next update.