Adobe known exploited vulnerabilities
Every Adobe CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 83 in all, 7 added in the last 12 months.
- CVE-2015-3113Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11
- CVE-2015-0313Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before
- CVE-2015-0311Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu
- CVE-2014-9163Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.
- CVE-2018-4939Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of UntrusteAdobe ColdFusion ColdFusion Update 5 and earlier versions,…
- CVE-2018-4878A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.Adobe Flash Player before
- CVE-2018-15961Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploaAdobe ColdFusion
- CVE-2013-2729Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbit
- CVE-2012-2034Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236
- CVE-2016-7892Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFieAdobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and…
- CVE-2016-4171Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors
- CVE-2010-2861Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re
- CVE-2009-0927Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e
- CVE-2017-11292Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be usAdobe Flash Player
- CVE-2016-7855Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote atta
- CVE-2016-4117Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil
- CVE-2016-1019Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit
- CVE-2015-7645Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows rem
- CVE-2015-5119Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296
- CVE-2015-3043Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att
- CVE-2014-0496Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers
- CVE-2013-3346Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a
- CVE-2013-0641Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute
- CVE-2013-0640Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or c
- CVE-2013-0632administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitr
- CVE-2012-1535Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote a
- CVE-2011-0611Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.
- CVE-2010-0188Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (a
- CVE-2008-2992Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file t
- CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code executionAdobe Magento Commerce · magento/community-edition
- CVE-2021-28550Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionAdobe Acrobat Reader
- CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionAdobe Acrobat Reader
FAQ
Adobe KEV questions.
How many Adobe vulnerabilities are in CISA KEV?
83 Adobe vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 7 of them added in the last 12 months. The newest is CVE-2026-48356 (Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability), added 2026-10-27.
Which Adobe products are in CISA KEV?
13 products, including Commerce and Magento, ColdFusion, Acrobat and Reader. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Adobe KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 11 of the 83 Adobe entries.