Does anyone know what we need to check for / change in our code to be compatible with this patch?

The big thing for us is that only explicitly declared arguments are honored for methods whose access="remote", whether you're actually calling it remotely or not.

We're seeing that when you append

returnformat=json

then it blocks it, if you remove that param it you get WDDX

@aliaspooryorik "We're seeing that when you append

returnformat=json

then it blocks it". Are you saying that that causes remote requests to be blocked regardless of what arguments are declared or passed? That undeclared args are only blocked with returnformat=json? Something else?

Sorry - missed your reply. So turns out that

returnformat

is allowed. We had a url variable being paramed in Application.cfc that was causing it to be blocked