CVE-2009-3960: Adobe BlazeDS XML External Entity Information Disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and a public exploit exists, so active exploitation is likely.

What it is

BlazeDS 3.2 and earlier, along with related LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion versions, mishandles XML documents containing injected tags and external entity references. A remote attacker can craft a request that causes the server to resolve external entities and return sensitive information. The flaw is an XML external entity (XXE) style information disclosure.

Impact

An attacker can read files or data accessible to the affected server process and exfiltrate sensitive information through the response. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the affected BlazeDS or related Adobe service. No authentication is required, but the CVSS vector indicates user interaction is required, likely to trigger the crafted XML processing path.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-07 with known ransomware campaign use, and EPSS is 0.90012 (99.8th percentile). A public Exploit-DB entry (41855) exists, so exploitation is well established.

What to do

• Apply the vendor updates referenced in Adobe security bulletin APSB10-05 for all affected BlazeDS, LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion versions.
• Disable external entity resolution and DTD processing in XML parsers used by BlazeDS and related services.
• Restrict network access to BlazeDS and related endpoints to trusted clients only.
• If the product is end-of-life and cannot be patched, isolate or decommission the affected service.
• Monitor for and block requests containing XML external entity or DOCTYPE declarations at the edge.

Detection

• Inspect HTTP request bodies to BlazeDS and related endpoints for DOCTYPE, ENTITY, or SYSTEM/PUBLIC declarations.
• Alert on responses containing file contents or unexpected local paths returned from XML-processing endpoints.
• Review server logs for anomalous XML payloads or repeated requests to the same endpoint from a single source.
• Use the public Exploit-DB proof of concept (41855) to build detection signatures for known exploit patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.