Adobe known exploited vulnerabilities
Every Adobe CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 83 in all, 7 added in the last 12 months.
- CVE-2013-2729Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbit
- CVE-2012-2034Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236
- CVE-2016-7892Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFieAdobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and…
- CVE-2016-4171Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors
- CVE-2010-2861Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re
- CVE-2009-0927Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e
- CVE-2013-0631Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in
- CVE-2013-0629Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspeci
- CVE-2013-0625Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe
- CVE-2009-3960Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and
- CVE-2017-11292Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be usAdobe Flash Player
- CVE-2016-7855Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote atta
- CVE-2016-4117Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil
- CVE-2016-1019Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit
- CVE-2015-7645Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows rem
- CVE-2015-5119Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296
- CVE-2015-3043Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att
- CVE-2014-0496Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers
- CVE-2013-3346Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a
- CVE-2013-0641Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute
- CVE-2013-0640Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or c
- CVE-2013-0632administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitr
- CVE-2012-1535Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote a
- CVE-2011-0611Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.
- CVE-2010-0188Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (a
- CVE-2008-2992Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file t
- CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code executionAdobe Magento Commerce · magento/community-edition
- CVE-2018-15982Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
- CVE-2021-28550Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionAdobe Acrobat Reader
- CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2018-4939Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of UntrusteAdobe ColdFusion ColdFusion Update 5 and earlier versions,…
- CVE-2018-4878A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.Adobe Flash Player before
- CVE-2018-15961Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploaAdobe ColdFusion
FAQ
Adobe KEV questions.
How many Adobe vulnerabilities are in CISA KEV?
83 Adobe vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 7 of them added in the last 12 months. The newest is CVE-2026-48356 (Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability), added 2026-10-27.
Which Adobe products are in CISA KEV?
13 products, including Commerce and Magento, ColdFusion, Acrobat and Reader. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Adobe KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 11 of the 83 Adobe entries.