---
id: "CVE-2009-3960"
kind: "vulnerability"
aliases: ["CVE-2009-3960"]
title: "Adobe BlazeDS: Adobe BlazeDS Information Disclosure Vulnerability"
severity: "medium"
cvss: 6.5
epss: 0.90118
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe BlazeDS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-blazeds", "coldfusion", "exploited", "java", "lifecycle", "package", "ransomware"]
not_affected_if: ["no-blazeds-installed"]
published_at: "2010-02-15T18:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3960", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-3960", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3960", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe BlazeDS: Adobe BlazeDS Information Disclosure Vulnerability

Adobe BlazeDS, a Java remote-messaging library used by LifeCycle and ColdFusion, has an information disclosure flaw. CISA lists it as actively exploited, and ransomware use is tagged in the source data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe BlazeDS affected ? fixed ?

## Fix

Apply the updates per the vendor instructions (CISA KEV required action); the fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3960
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-3960
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-3960

## From the sources

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_