Is CVE-2009-3960 being actively exploited?

Yes. CVE-2009-3960 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 7, 2022.

What is the CVSS score for CVE-2009-3960?

CVE-2009-3960 has a CVSS 3.1 base score of 6.5 (MEDIUM).

CVE-2009-3960

MEDIUM · CVSS 6.5CISA KEV: actively exploitedEPSS 90.1%EU EUVD: exploited

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Key facts

CVSS score: 6.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS score: 90.1% (100th percentile)
In CISA KEV: Yes, added March 7, 2022
In EU EUVD: Yes (EUVD-2009-3931)
Published: February 15, 2010
NVD last modified: August 6, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe BlazeDS Information Disclosure Vulnerability

Added to the KEV catalog on March 7, 2022; federal remediation due September 7, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-3931 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 6, 2026.

View on the EU Vulnerability Database

Affected products

adobe / blazeds
adobe / coldfusion
adobe / coldfusion
adobe / coldfusion
adobe / coldfusion
adobe / flex data services
adobe / livecycle
adobe / livecycle
adobe / livecycle
adobe / livecycle data services
adobe / livecycle data services
adobe / livecycle data services

References

http://secunia.com/advisories/38543(Broken Link)
http://securitytracker.com/id?1023584(Broken Link, Third Party Advisory, VDB Entry)
http://www.adobe.com/support/security/bulletins/apsb10-05.html(Not Applicable, Vendor Advisory)
http://www.osvdb.org/62292(Broken Link)
http://www.securityfocus.com/bid/38197(Broken Link, Third Party Advisory, VDB Entry)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960(US Government Resource)
https://www.exploit-db.com/exploits/41855/(Exploit, Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain