Is CVE-2009-1599 actively exploited?

No active exploitation of CVE-2009-1599 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2009-1599 be exploited remotely?

Yes. CVE-2009-1599 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2009-1599?

CVE-2009-1599 has a CVSS score of 9.3 (CRITICAL).

HOME VULNERABILITIESCVE-2009-1599

CRITICAL

CVE-2009-1599

CWE-264Published: May 11, 2009· Updated: Jun 16, 2026

9.3

CVSS v3.1

Official Description

Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."

NVD Source

Technical Analysis

CVE-2009-1599 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.