Adobe known exploited vulnerabilities
Every Adobe CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 83 in all, 7 added in the last 12 months.
- CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2009-3459Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exe
- CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2020-9715Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier havAdobe Acrobat and Reader
- CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition +1
- CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)Adobe Experience Manager
- CVE-2017-3066Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializaAdobe ColdFusion ColdFusion 2016 Update 3 and earlier, Cold…
- CVE-2024-20767ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2014-0502Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and b
- CVE-2014-0497Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1
- CVE-2013-0648Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.
- CVE-2013-0643The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 an
- CVE-2024-34102XXE can expose crypt key and other secrets granting full admin accessAdobe Commerce · magento/community-edition
- CVE-2023-38203Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEAdobe ColdFusion
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-21608Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26369[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildAdobe Acrobat Reader
- CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-38205ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298Adobe ColdFusion
- CVE-2023-29298Adobe ColdFusion Improper Access Control Security feature bypassAdobe ColdFusion
- CVE-2023-26360Adobe ColdFusion Improper Access Control Arbitrary code executionAdobe ColdFusion
- CVE-2013-0631Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in
- CVE-2013-0629Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci
- CVE-2013-0625Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe
- CVE-2009-3960Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and
- CVE-2018-15982Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
- CVE-2018-4990Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.0…
- CVE-2012-5054Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to exec
- CVE-2012-0767Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, a
- CVE-2012-0754Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x
- CVE-2011-2462Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x
- CVE-2011-0609Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on
- CVE-2010-2883Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows
- CVE-2010-1297Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3,
- CVE-2009-4324Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before
- CVE-2009-3953The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remot
- CVE-2009-1862Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.
- CVE-2008-0655Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.
- CVE-2007-5659Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with
- CVE-2016-1010Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577
- CVE-2016-0984Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2
- CVE-2015-8651Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on
- CVE-2015-0310Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not p
- CVE-2014-8439Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR bef
- CVE-2014-0546Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, an
- CVE-2018-5002Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability.Adobe Flash Player 29.0.0.171 and earlier versions
- CVE-2015-5123Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.30
- CVE-2015-5122Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0
FAQ
Adobe KEV questions.
How many Adobe vulnerabilities are in CISA KEV?
83 Adobe vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 7 of them added in the last 12 months. The newest is CVE-2026-48356 (Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability), added 2026-10-27.
Which Adobe products are in CISA KEV?
13 products, including Commerce and Magento, ColdFusion, Acrobat and Reader. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Adobe KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 11 of the 83 Adobe entries.