This probably flew under the radar to many but Adobe has recently updated one of their support docs on upgrading JVM in ColdFusion, they now clearly state that you can upgrade to the latest minor release of a supported jvm version in ColdFusion:

All ColdFusion users can upgrade Java to the latest minor version for their ColdFusion servers. For example, ColdFusion customers using jdk 1.6.0_x can upgrade to the latest jdk 1.6.0_x update. (At the time of writing, the current version is jdk 1.6.0_35.) All future JDK 1.6.0_x releases are supported.

See http://helpx.adobe.com/coldfusion/kb/upgrading-java-coldfusion.html for details.

This is great news because Oracle frequently releases security and bug fixes for Java, and ColdFusion customers have been reluctant to upgrade the JVM in the past due to worry about Adobe Support.