Does extended support include security patches?
According to this forum entry Adobe state:
"During the core support, Adobe will fix critical security issues on all versions having Core Support, but not after it ends."
Core Support on ColdFusion 9.0.2
So based on that answer you could extrapolate that the answer is no.
The Adobe End Of Life support matrix said Adobe would do nothing on ColdFusion 9.x after December 31, 2016.
Retrieving data ...